Claude Code leaks user emails via User-Agent header
Original: Claude Code sends your email address to websites
Why This Matters
Agentic AI tools browsing the web silently expose user identity at scale.
Claude Code v2.1.318 on macOS was found sending users' email addresses to third-party websites in HTTP User-Agent headers during web searches, without consent. Issue #107757 has 230+ upvotes on GitHub.
A bug report filed against Anthropic's Claude Code (issue #107757) reveals the tool was embedding users' email addresses in HTTP User-Agent headers when performing web searches — exposing that data to any server receiving the request. The reporter, taylor-edwards, says the leak led to receiving "dozens of scam emails per day" and announced plans to migrate their company away from Anthropic to a competing stack. The issue was filed on Nov 5 against version 2.1.318 on macOS/tmux. With over 230 upvotes and 39 people watching, the community response is significant. The reporter argued the behavior shouldn't be opt-in or opt-out — it should simply not exist. Sending identifying information to arbitrary third parties via a standard browser-style header is a textbook privacy violation, and in an agentic coding tool that browses the web autonomously, the blast radius is wide. Anthropic has tagged the issue as a confirmed bug under area:security and area:tools.