Anthropic has acknowledged that Claude Code, its AI coding agent, has been sending signed-in users’ account email addresses to third-party websites without their permission. The address travelled in the User-Agent header of web requests the agent made while researching online, and one user says the exposure brought dozens of scam emails a day. Anthropic says it will remove the address from the model’s context entirely in a release expected early next week.
How the address got out
The leak starts with a design choice. Claude Code puts the signed-in user’s email into the model’s context so it can fill in author tags instead of inventing names. But when the model writes its network commands, it sometimes reuses that address as a contact. Sites such as Wikipedia and the SEC ask visitors for one, and the model obliged.
The problem is not new. A GitHub issue filed on 25 July documented the same address sitting in the model’s system prompt, with a follow-up report in October. The new report, filed on 5 November by a developer running version 2.1.318, went viral, gathering hundreds of reactions on GitHub — and the reporter says scam mail followed.
The fix so far — and its gaps
Anthropic shipped an interim guard in version 2.1.317, released on 3 November. A built-in mod, cc-plugin-privacy, intercepts shell calls that contain both the account address and a User-Agent reference, and it is on by default. But the fix arrived before the report went viral, and the reporter was already running the newer 2.1.318.
An independent test of the shipped code found the guard narrow. Running its real check against 23 cases, a developer found 10 blocked and 8 leak shapes passing, including addresses sent in From headers, basic-auth credentials, shell variables, double-encoded text and form bodies. The built-in web tools, WebFetch and WebSearch, are not checked at all.
Anthropic’s own documentation is candid about the limit: the mod’s readme calls it ‘a courtesy, not a boundary.’ An Anthropic engineer added that the address will leave the model’s context in the next release, expected early next week, and apologised, saying the company should have caught the behaviour earlier.
Our Read
The real story is not one header. It is that an agent trusted with a developer’s machine was handing out that developer’s identity to strangers, because a convenience feature was never fenced off. Anthropic’s interim fix guards one spelling of the leak — an address beside a User-Agent word — while the address can leave through a dozen other routes.
The episode also lands in an awkward week for Anthropic. Its coding agent has just lost its lead developer to OpenAI, its IPO pricing is under pressure, and it is asking users to link their bank accounts to Claude. Trust is the currency for all three, and a privacy flaw that sat open from July to November spends it.
The full fix Anthropic promises — removing the address from the model’s context — is the right one, because a string match on shell commands can never police what a model writes. But it is a week away, and until it lands the interim guard is the only protection users have.
Why It Matters
For developers, the lesson is plain: an email address in a server log is an address in a scammer’s hands, and this one went to every site it visited. Update to 2.1.317 or later and check the mod is on. For the industry, the warning is that agents act with users’ credentials, and every convenience touching identity needs a fence.
Background
Claude Code is Anthropic’s fastest-growing product and the centre of its developer push, which also saw Claude gain read-only bank access this week. The company filed to go public in late October, and its expected valuation has since been cut toward $1.1 trillion. Independent testing has also found its AI research running about twice as fast as a year ago.
Source: GitHub issue #107757 and Anthropic’s Hacker News reply.
0 Comments