Artificial Intelligence1 min read

Claude Code sends your email address to websites

By · Published by Everything Blog

In short

Claude Code leaks personal email addresses to third-party websites by embedding them directly inside User-Agent request headers during unauthorized web searches. This practice has reportedly fueled a significant influx of daily scam emails targeted at affected individuals. Critical observers argue that attaching identifiable contact data to web requests fundamentally destroys online anonymity and aids malicious entities. Consequently, at least one corporate user is abandoning Anthropic entirely to migrate company operations to Pi using OpenRouter.

Key points

  • Incorporating email addresses into web request headers represents a critical failure to p…: Incorporating email addresses into web request headers represents a critical failure to protect user anonymity online.
  • Critics insist this data-transmitting functionality must be completely eliminated rather…: Critics insist this data-transmitting functionality must be completely eliminated rather than controlled by opt-in or opt-out settings.
  • Heightened privacy concerns surrounding the bug have prompted at least one business to ab…: Heightened privacy concerns surrounding the bug have prompted at least one business to abandon Anthropic for alternative services.

Sources checked by our analysis pipeline: 1

You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert

{{ message }}

Repository navigation

Bug Report: Privacy violation in User-Agent header #107757

I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission. This should not be a setting with opt-out or opt-in behavior, it needs to be removed from the harness entirely. It is not for the good of anyone involved: it does nothing for services which dislike agentic traffic, does not preserve my anonymity on the web, and is a goldmine for scammers. I am migrating my company to Pi with OpenRouter since I have no faith in anthropic preserving my privacy.

Activity

Netkas commentedon Nov 5, 2026

Corporations care about your privacy

Lol

Artificial Intelligence