Anthropic's Claude Code Leaks User Emails Via HTTP Headers

Anthropic's Claude Code AI tool is facing scrutiny following a user report detailing the alleged leakage of their email address to third-party websites via HTTP User-Agent headers. The incident, reported on GitHub by user taylor-edwards, suggests that Claude Code version 2.1.318 may inadvertently include personal email addresses in requests made during web searches, potentially exposing users to spam and phishing attempts.

The user claimed to have started receiving "dozens of scam emails per day" after using the tool, and expressed a strong desire for the behavior to be entirely removed rather than configurable. While the GitHub issue does not provide concrete evidence such as raw HTTP requests or sample headers, other users have reported similar experiences, indicating a potential systemic issue. The core of the problem appears to lie in how the AI agent handles context, with one explanation suggesting Claude might use an email address available in its context as a contact address when generating web requests, such as those made by curl.

This alleged leak differs from previous security concerns involving Claude Code, which have focused on unauthorized relay services or malicious extensions. Instead, this issue points to a privacy vulnerability inherent in the AI's routine operation of accessing external web resources. The User-Agent header, typically used to identify the client software, is not intended to carry sensitive personal information like email addresses.

Anthropic appears to be aware of the issue and is reportedly working on a solution. A cc-plugin-privacy module was introduced in versions 2.1.317 and later, designed to prevent such data leakage. This module is reportedly enabled by default. However, the original reporter was already using a later version (2.1.318), and several commenters questioned the module's effectiveness, with some unable to locate it or finding that it did not block local tests containing email addresses in the User-Agent string.

Adding to the concern, a Claude Code employee reportedly acknowledged gaps in the interim protection and stated that Anthropic plans to remove account emails from the model's context in an upcoming release. This admission suggests that while a privacy module exists, it may not be fully effective in all scenarios, and the underlying mechanism for handling sensitive data within the AI's operational context needs further refinement.

This incident underscores the broader challenges in securing AI agents, particularly those designed to interact with the internet. The report serves as a critical reminder for organizations to carefully review the network commands generated by their AI agents and to rigorously verify the efficacy of privacy controls before granting them broad web access. The potential for sensitive data to be inadvertently exposed, even through seemingly innocuous operations like web searches, highlights the need for robust security measures and continuous vigilance in the rapidly evolving AI landscape.

Users and organizations employing Claude Code are advised to monitor Anthropic's official communications for updates regarding patches and improved privacy safeguards. Until then, exercising caution and implementing additional layers of network monitoring and data loss prevention may be prudent.