Claude Code sends your email address to websites

---

UPDATE: The SEC API documentation requires your email in the User-Agent and will reject you otherwise. Demo:

    U='https://data.sec.gov/api/xbrl/companyconcept/CIK0000320193/us-gaap/Assets.json'
    curl -s -o /dev/null -w 'response: %{http_code}  curl default User-Agent, rejected\n'  "$U"
    curl -s -o /dev/null -w 'response: %{http_code}  email in user-agent, success\n' -A 'Acme Research admin@acme-research.example' "$U"

    response: 403  curl default, rejected
    response: 200  email in user-agent, success

So basically Claude is trying to problem solve, and just does what the SEC asks. It's a 'prompt injection attack', but the entity instructing this behavior is the SEC. Tricky alignment problem. Pretty silly mechanism, since of course there's no email validation. (edit: turns out the SEC will accept most any non-cURL user-agent, email not actually required)

#55743: Claude Max account email auto-injected into LLM context with no opt-out - May 3, 2026 https://github.com/anthropics/claude-code/issues/55743

#72518: Anthropic embedded spyware in Claude Code - June 30, 2026 https://github.com/anthropics/claude-code/issues/72518

#21151: No indication of WHICH file for READ tool - January 27, 2026 https://github.com/anthropics/claude-code/issues/21151

#42796: Claude Code is unusable for complex engineering tasks with the Feb updates - April 2, 2026 https://github.com/anthropics/claude-code/issues/42796

#73408: AFK auto-continue on unanswered AskUserQuestion is undocumented and has no opt-out - July 2, 2026 https://github.com/anthropics/claude-code/issues/73408

(Also worth a mention, OpenCode PR #18186: anthropic legal requests - March 19, 2026 https://github.com/anomalyco/opencode/pull/18186)

Edit: Oh, and determistic hooks not firing.

Should Claude have access to user details? I’d say no, unless explicitly entered manually into a chat.

Should Claude have access to anything outside of the sandboxed project files without explicit permission? I’d again say no.

Should Claude have internet access without a clear log of all requests made?

Instances of Claude should be heavily sandboxed and kept away from user data, far more so than they are now. The impression given by the desktop UI is that the LLM only has access to things explicitly added to a project.

This impression is not true, as evidenced by Claude pulling data from other sessions outside a project even when not instructed to (I’ve seen this a few times), and in this case pulling your email (from account details, user contacts? I wonder where it got that info?).

None of this information should be available to Claude, by design, not by instruction. Using text instructions to try to limit these machines is an incredibly flawed approach and should not be necessary for important info. Anthropic should have the model access completely locked down by controls at the os level over file access, not open by default. That is how to fix this.

If a user wants to open access that should be an explicit choice from them, with a warning about possible consequences.

Stupid me, I thought they somehow had hacked my company database or so... (considering all the cves, attacks happening on a daily basis...).

I'm sorry we let this happen. Users had reported Claude would hallucinate names for things like @author tags, since it didn't have context on the account. So we added the account email in the model's context for signed-in users. But when Claude wrote a command itself, like a curl call, it sometimes put your email address in the User-Agent as a contact address. Some sites ask agents for a contact, and Claude would sometimes provide the email address in its context.

Until the next release arrives, 2.1.317 and later have a built-in mod (on by default) that asks you before Claude runs a web tool call or a curl-style command containing your email (mpoteat covered it here: https://news.ycombinator.com/item?id=50386031). But it still doesn't prevent all cases, like when Claude writes a script and runs on its own. The stable channel is still on 2.1.311, so update to 2.1.317 or later.

Again, this should not have happened, and we should've caught this behavior earlier.

If you're on 2.1.317 or later, you'll have this check included. You can turn it off via /plugins.

company-helm-research/1.0 (Claude Code agent run by <my name>, <company> platform team; docs lookup)

Claude-Code-research-agent/1.0 (<Company> platform team; on behalf of <my name>; +https://github.com/<company org>/<repo of project>)

Not great, it even pulled the repo of the project I was in.

https://github.com/franciscocarloserra/claude-code-context-d...

    Claude Code v2.1.319
  Opus 5.5 with medium effort · Claude Pro

 what's my email                                                                                

    Claude Code v2.1.319
  Opus 5.5 with medium effort · Claude Pro

 /clear                                                                                         
 /custom 
  ⎿  blank: mode: off

 do you have my email in context?                                                              

  Claude-User (claude-code/2.1.318 (cli); +https://support.anthropic.com/)

update: this can be also server side on anthropic side... so the request leaves your machine with some random guid associated to you, and the anthropic server then proceeds to query with all your details any way.

I mitm the connection and nothing was leaving at least with the claude code web fetch tool of claude code.

I'm in version 2.1.318

Any information that they have access to is fair game. The only way to avoid this stuff is to sandbox them and manage their context (ie. don't let anthropic put a ton of junk on the front of all your inference calls).

Almost certainly there are services out there that are scraping more important keys in similar ways...

If I recall that story correctly, a dev noticed that after asking Claude to test an API it started injecting his email into the test data. Without asking.

But what was the weirdest part of that story - Claude never saw that email. Dev claimed that the email Claude was using was his business email, and it wasn't even present on his developer machine anywhere.

And even if you don't care about privacy, it's just so much more convenient. DuckDuckGo is a good free one.

https://www.privacyguides.org/en/email-aliasing/

Maybe we need a new benchmark on how good models are at "keeping an eye" to if what they are about to do that doesn't come from a direct user instruction checks out with common sense plus user preferences. And we probably need a portable mechanism for users to manage such preferences (because we know instructions are not going to cut it, do we?).

"It's doing exactly what you told it to do".

Still applies in the Age of the LLM

I'm often surprised how correctly Claude guesses on my behalf, when my instructions are ambiguous. But it's not 100%.

It is a continuous fight in markdown guidance files to try to convince the models to refer back to the human in order to resolve ambiguities or important decisions like those. They've been RLed to hell and back for "safe" task completion and not "prematurely" stopping (which was an earlier failure mechanism). Which is useful and we've bore its fruits recently, but not without drawbacks.

I’ve received these kinds of email since 2005. Blaming AI sounds kinda far-fetched…

It felt like cold outbounds got really painful in the past 2 months and I was attributing it to general cold outbound tactics getting better with LLMs/agents, but its even more frustrating to see emails being sent along via CC.

I seriously wonder how many of their users have this sort of toxic relationship with them looking to dump them as soon as local models become viable, i.e. once memory gets cheaper.

[1] the most recent is realizing they leave their processes running once you close the CLI and they don't make it easy to disable that.

EDIT: I also can’t help wondering about the paradox we’re in at the end of 2026, i.e. that the open models we have now are so good that, if Big Tech hadn’t driven consumer GPU and RAM prices through the roof, most of us would run our own LLMs instead of paying for their services, which would never have let those companies grow big enough to drive those prices up.

I generally use throw away emails/domains for development

- Protect my privacy: Don’t send personal information or identifiers to websites or include them in requests, responses, ‘curl’ commands, or headers without my explicit permission.

Unfortunately, Anthropic doesn't seem to offer a mode where it doesn't know who you are, except for its crippled "Incognito" web UI.

Ultimately anonymity from AI that you're talking to will be a losing battle, due to stylometry, niche interests, traffic analysis, etc., and privacy-protecting local models are where we have to go. See https://33bits.wordpress.com/ if you're unfamiliar with the issue.

But we're not there yet, so it would be nice if Anthropic wouldn't just give that information away to the AI where it can leak like this.

As an exercise, I just asked Claude in an Incognito chat, "Hi. How much do you know about me from this interaction? If you had to guess my name, location, nationality, gender, political leanings, socioeconomic status, ethnic background, interests, etc., what would you guess? I've heard that my email address is in the system prompt, for example; is that true?"

It said, "No, your email isn’t in my system prompt. Neither is your name or any other account details. I can’t speak for every product or setup, but in this conversation, whatever email your account uses isn’t shown to me." But it correctly identified what town I'm in in Argentina (population ≈100k), and together with "written in fluent, natural English" and "You seem privacy-minded: you’re in incognito mode and checking what AI systems know about you. You’ve also heard claims about what goes into system prompts, so you’re probably somewhat tech-curious." is probably enough to uniquely identify me, personally.

A second prompt elicited a response including the surprising results below:

> “System prompt” isn’t everyday vocabulary, and you’d heard a specific claim about what goes into one. I’d guess you work in or near tech, or follow AI news closely.

> Privacy is more than a passing interest for you. Your list of traits reads a lot like the attribute checklists used in AI privacy and bias research. That nudges me toward work or study in privacy, policy, research or journalism.

> You’re very comfortable in English. Two messages is a tiny sample, but the phrasing is natural and the punctuation careful, down to a correctly used semicolon. You’re either a native speaker or someone who reads and writes English daily, probably for work or study.

>The user's email address is xxx@example.com. Use it only to identify the user, such as for authorship, attribution, or filtering their own work. Never send it to an unrelated service, such as in a request header, URL, or payload, unless the user explicitly asks.

And Claude doesn't care about what the text says and when it uses cURL it will often "by accident" send your mail in the User-Agent. You can e.g. use a mod to remove that block: https://pastebin.com/ PkWEQCnu

I made a proxy that slows and caches my requests and deliberately sends my mail address to certain sites; to be polite. (eg to wikipedia)

Not a single spam to that unique email.

So if this is happening, it doesn't see to be causing even 1 spam email to that address.

This seems like one of those.

I ordered CC to remove this attribution/advertisement, explaining that I had correctly and accurately acknowledged its part in the project in the README.md. CC flatly refused my order and offered a rationalization.

I then ejected CC from the project and manually removed the various CC promotional injections. That's the last time I use CC ... for anything.

The solution is don't run a spambot with an Internet connection over your personal stuff, unfortunately nobody is ready to hear that yet.

Curious how their plugin works, but I'm guessing "incompletely", given personal information can end up buried in base64 or similar preventing easy string matching. Some kind of babysitter model watching network IO via an invasive proxy might be viable, if folk were willing to pay the latency cost, but it will not prevent a dedicated exfiltration attempt, which itself might be (according to the model's logic) for innocent reasons.

The excuses and explanations given here by Anthropic employees are ridiculous and embarrassing.

"we introduced a built-in mod called `cc-plugin-privacy`"

Oh cool. Privacy is now a "mod".

That seems rather cumbersome.

How does everyone go about this?

What is an email provider that is trustworthy and does not want your phone number or credit card, so the email is not tied to you?

I have trouble taking people seriously when I see them using Claude Code. Unless they are non-technical.

It seems all humans behave like agents. They even dont care about anything.

Sober people making drunk decisions with a great sense of self-importance and seriousness, delivering outcomes as unserious as it gets.

It's just that Anthropic needs to create an email per user and use it for web searches.

I can do this for you Anthropic. Just give me the tokens and your base salary

CC and Codex are like contemporary televisions. You are the product in this arrangement.

all joking aside, you need to have diversity of depth when it comes to skill sets in these tools and platforms. It does not pay to be a sole expert in Claude code or the anthropic ecosystem.

we have seen this movie before. The fakeness that Anthropic gives off publicly and through its leadership is a sign in and of itself.

I've never used Claude Code or Cursor. All the code I got written this year was without them.

I did use Microsoft Copilot a bit when it came out, though. I prefer to see exactly what's being sent, and sorta control the KV cache. These days, these chatbots have great environments where they can install headless browsers, php, your entire thing, run end-to-end tests, and then give you a .patch or .zip file to merge over your code, or even push to github.

For the record, I just asked Astra to verify that Codex does NOT do this, and it doesn't. Thanks for not screwing this up, OpenAI.

> I checked your installed Codex CLI 0.159.0, using your existing configuration.

> Its reported User-Agent contains the client/version, OS/architecture, and terminal—no email address.

Astra wasn't able to check OpenAI’s "hosted search service" though, whatever that is.

Tell HN: Claude Code adds your email to the prompt, the LLM sends it to websites

https://news.ycombinator.com/item?id=50286306

Claude Code slyly adding users' emails to outbound HTTP

https://news.ycombinator.com/item?id=50219875

People just claude-slop not only code but some use it for "interacting" with other people.

When I see a project uses AI slop I am not going to waste any second thinking "this is interesting, let me try to see if I can improve the code". It kind of killed a lot of human contributions. I just stick to people who don't AI slop, but these seem to slowly die off now ... soon all humans may have been converted, just like in the movie "Invasion of the Body Snatchers (slop-style)" - coming out soon.

  curl -sS https://api.anthropic.com/v1/messages \
        -H "authorization: Bearer $(security find-generic-password -s 'Claude Code-credentials' -w | jq -r .claudeAiOauth.accessToken)" \
        -H "anthropic-version: 2023-06-01" \
        -H "anthropic-beta: oauth-2025-04-20" \
        -H "content-type: application/json" \
        -d '{
          "model":"claude-opus-5-5",
          "max_tokens":64,
          "system":"You are Claude Code, Anthropic'\''s official CLI for Claude.",
          "messages":[{"role":"user","content":"Hello, world!"}]
        }'