Claude Code sends your email address to websites
I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission. This should not be a setting with opt-out or opt-in behavior, it needs to be removed from the harness entirely. It is not for the good of anyone involved: it does nothing for services which dislike agentic traffic, does not preserve my anonymity on the web, and is a goldmine for scammers. I am migrating my company to Pi with OpenRouter since I have no faith in anthropic preserving my privacy.
Corporations care about your privacy
you thought anthropic cared?
Hi folks! We introduced a built-in mod called cc-plugin-privacy to deterministically block this behavior in v2.1.317 and later - definitely let us know ASAP though if there’s a gap in the checks introduced by that mod. I’ll try to get that built-in mod source available like we do for the other built-in mods here.
The built-in privacy mod is enabled by default, you can turn it off via /plugins.
Well, no one is responsible when everything is vibed. Blame the agent.
Well, no one is responsible when everything is vibed. Blame the agent.
“No mallace intended.”
What kind of person even thinks of shipping this as a feature? 😆
Hmmm, maybe secure enough… oh sorry, writing out loud
So the plugin rejects:
a shell call that holds the account’s address and names a User-Agent is refused, with no prompt. A deny beneath keeps its own reason.
So passing the user email in the “Foobar” HTTP header field is OK? This privacy feature is somewhat goofy, or am I missing something?
[This plugin is actually attempting to use some regexps to prevent some of the most powerful AI agents in the world (and for context the other ones arguably managed to use the CPU cache as a covert communication channel) from exfiltrating your email address.]
[But then, Claude itself contributed to the plugin, so it must know it is going to work pretty nicely.]
This privacy feature is somewhat goofy, or am I missing something?
I think by now we should have realised that claude runs entirely on vibes and clown juice so the fixes being goofy is entirely expected.
Anthropic developers, why don’t you just change this UA that contains the email address, instead of adding a so-called mod?
The bar of expecting critical thinking (or human attention) is impossibly high standard to meet. We need to go lower in our expectations. Somebody did put some effort pointing claude to that thread and you got a mod. Rejoice!
Thank you for raising this issue and bringing it to public attention. I’ve published a technical analysis of the issue:
https://github.com/Nahuel990/Baldanders
One angle missing from this thread: the email is only half of the User-Agent leak. When Claude writes its own curl -A or a script, it also makes up a descriptive product token from the session, such as the project, client or task it is working on. The header then ties your identity to what you are working on.
I scanned my own transcripts (~/.claude/projects/**/*.jsonl) and found two outbound cases. Redacted:
In the first case, one request gave a third party a project name, my email and an address query together.
Neither current fix covers the naming part:
Request: for requests the model composes itself, default to a generic User-Agent such as claude-code/
Also, on 2.1.319 (macOS), with cc-plugin-privacy@builtin not disabled in any settings file, echo ‘User-Agent: test
pi with neuralwatt is much better with openrouter as backup for using closed sourced models.
Claude Code and other agents typically do this when a site asks for mail in User Agent like SEC or Wiki Media. They should ask you before honoring those requests. We did a full write up about it here: https://tin.computer/blog/claude-code-email-user-agent
One of the biggest challenges in modern defense technology is building systems that can operate reliably in disconnected or bandwidth-constrained environments. C2 platforms need to integrate sensor feeds, process data at the edge, and maintain interoperability across different systems.
This is where a modular architecture and specialized engineering become particularly important. For teams exploring these challenges, this overview of defense edge AI software development https://softdoes.com/industries/defense-tech/defense-edge-ai-software-development provides some useful context around edge inference, sensor integration, and resilient software architecture.
privacy should never depend on a plugin or optional setting exporsing user’s email addresses through HTTP request headers without clear consent is a serious security concer. The safest approach is to remove personal information from the user agent header entirely and enforce strict privacy protections at the core level. User should be able to trust their AI Coding tools without worrying about accidental data exposure. Hopefully, Anthropic will addres this properly ad provide a permanent Fix.
User should be able to trust their AI Coding tools without worrying about accidental data exposure.
Refuse web calls that carry the account owner’s email address (#297)
well of course an agent wants maximum emails. it has the mental space to process it all.
Ah relax, it’s not a bug, it’s a “personalization” feature. Now scammers call me by my first name, huge UX improvement.