News2 sources33 comments in the community

Claude Code sends your email address to websites

Hacker News: Front Page · By motoroco · 14h ago

The Brief

Users report that Claude Code writes the account email into the User-Agent header of web requests, for example "my-session-slug/1 <my.name@example.com>".
A DEV Community post says stable Claude Code 2.1.311 lacks a guard against putting account emails in User-Agent headers.
A commenter reports that a system prompt block containing the user's email is the cause, and that Claude does not reliably follow its instruction not to send it to unrelated services.

Why it matters

Claude Code may disclose a developer's account email to third-party websites, which commenters link to spam and phishing aimed at work addresses.

Who’s affected

Claude Code users
Teams using Claude Code with work email addresses

What to do

Check your Claude Code version; a commenter says 2.1.317 or later includes a built-in cc-plugin-privacy check that can be turned off via /plugins

Claude Code 2.1.311
Claude Code 2.1.317
Claude Code 2.1.318
Codex CLI 0.159.0
#claude-code
#privacy
#user-agent
#anthropic
#data-leak

What developers are saying

Based on 33 comments · Mostly critical

Commenters largely see the behaviour as a privacy violation, with some reporting spam and phishing sent to work or project-related addresses. Others say they never saw spam on masked addresses, and a few argue the design makes sense for attribution. Several say they will switch away from Claude Code or are considering it if their organisation bans it.

Privacy violation concerns40%
Spam to work email20%
Hidden system prompt block15%
Loss of trust in Anthropic15%
Masked emails unaffected10%

In favour

+ The design may serve attribution, since Anthropic could use the email to identify users for web searches

Concerns

− The email reaches third-party sites, and some commenters link it to spam and phishing
− Claude does not reliably follow the system prompt instruction not to send the email to unrelated services
− Subagent requests also included user names and project repository details in headers
− Some commenters say their organisation may ban Claude as a result

“This violates the privacy of paying customers and has resulted in me getting dozens of scam and phishing emails per day”
motoroco on Hacker News

“This is insane, and if the org I work for bans Claude as a result I will not be the least surprised. Goodbye Claude Code.”
teruakohatu on Hacker News

“And Claude doesn't care about what the text says and when it uses cURL it will often "by accident" send your mail in the User-Agent.”
sunaookami on Hacker News