Stupid me, I thought they somehow had hacked my company database or so... (considering all the cves, attacks happening on a daily basis...).
Claude Code is not sending your email address to websites as a default, or regularly. It is not some automatic header or anything.
Rather, if you are performing certain kinds of research on sites that involves downloading certain kinds of information, like on Wikipedia or the SEC, it supplies your e-mail address when the sites request it as part of their download policy. As part of anti-bot policy. Obviously Claude should have asked for approval first, but Claude isn't out there just spamming your e-mail address in every external request it makes or anything.
Wikipedia and the SEC are not selling your e-mail address to spammers. And these are the two main sites where it has come up.
Usually this is from LinkedIn, GitHub, etc scraping... There are databases where they just guess and verify emails too
The medical world uses the terms indications and contraindications. I think we in IT could do with a similar process/procedure.
It can take a while for spammers to get your address on their list. Generally the amount of spam over time only goes up. Just because there's a correlation doesn't mean there is a causation. Anyone with an email address, including on a custom work domain, has experienced this and Claude wasn't responsible for all email spam lol
98% I look at a LinkedIn profile, my $SALES_LEAD Chrome extension shows me their email + phone.
(To be clear, not from LinkedIn, but given their name/city/company.)
If you're on 2.1.317 or later, you'll have this check included. You can turn it off via /plugins.
Best practice will forever be to enforce your guard rails in addition to Anthropics guardrails.
Offshoring understanding is the trend that many companies will pay in the form of comprehension debt.
Somebody on Reddit figured out they just forgot to add a single line permission request into the app. It's been broken now for months.
I just find this wildly hilarious given the 'world ending all powerful AGI is here' rhetoric they're running with at the same time.
Maybe before worrying about permanent 15% GDP growth or human annihilation, what if we started by putting an agent on user issues and solving them pro-actively?
I know the kool aid is tasty, but we might be getting a bit ahead of ourselves here guys. You can fantasize about human annihilation after you figure out how to make a desktop app that doesn't have obvious bugs, I promise :)
Guarding PII is an extra, I guess, and if you want to use a giant cloud-hosted NN to control software on your own device, there are very few default restrictions. And no matter what restrictions there are, when they go beyond prompting, they would have their own ShowHN.
For 99% of users, the model knows it's in the /home/joesmith/whatever repo and `git log` shows the last change was by `joe.smith@example.com` - trying to keep the user's identity secret from the model would be nigh-impossible so I think anthropic gave up on even trying.
Then, your agent invents a User-Agent and it sometimes invents one with your email in it.
It doesn't even require prompt injection or a failed request, it might be in the agent's pretraining knowledge that a given website requires a user-agent.
GitHub offers noreply email addresses
Wish that were itself behind a permission wall, but I guess everyone just uses auto mode anyway so perhaps that ship has sailed.
Common problem: you might consider it trivial to define a rule that forbids access to any file path outside the working directory. Allowing "safe" shell access is already a heuristic, there is no way around it:
- shell scripting is Turing-complete
- there are platform-specific paths that need to be at least readable to perform trivial tasks: Everything is a File!
- security models to make such low-level file access transparent exist, and generally work, but: they are never perfect (container environments, chroot etc). Because...
If someone else distributes my commits (or messages), I have no control over that, not any different from sending a physical letter?
I was saying "cloud-hosted" explicitly, and was speaking about what it means to have a remote control software?
Doesn't even matter much whether it's an Artificial Neural Network for the sake of my argument.
I never give a provider my actual email address, I recommend others do the same. Otherwise, it’s just a matter of time until it is leaked or otherwise part of a data breach.
“lethal trifecta”
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
(a component of my cybersecurity work is red teaming inference and agents)
This is why alignment is important and highly non-trivial
FYI, it's generally bad form to "haha" your way through privacy violations.
Leaking private information is a very big deal for a lot of people.
I disagree, we can likely never fully (or should?) trust models to do these things deterministically, that's why we have harnesses around the agent with built-in constraints.
It is actually in the name: https://en.wikipedia.org/wiki/Harness, https://en.wikipedia.org/wiki/Safety_harness
Anthropic should have been aware of this since the user's login email address was inappropriately added to the system prompt. It's been informed of it by third parties since at least July: https://github.com/anthropics/claude-code/issues/81138
It makes no sense for an email address only used for authentication to be given to Claude Code, so the fix should be to remove it from the system prompt, not to add a plugin.
Which is great! It's good for the community when people give quick updates here, and to make sure that it continues, it's important that we respond respectfully. (I don't think your post was disrespectful, but commenters have crossed that line in other situations in the past.)
When I'm talking to customer service people after a particularly egregious ordeal, I tend to edit myself and replace "you" (plus "you bastards", "you idiots", etc. ;) ) with <Company Name> for this same reason.
[1] and yes it seems very realistic that Claude himself may be the jackass responsible.
If you’re in the EU, send a complaint to your data protection authority.
I imagine quite a few would be very interested in following up and investigating here, and getting Anthropic to drop the email from the system prompt.
Nice that this time we get the company to admit it in public, and that they've been aware of that earlier but only acted now.
I suspect the privacy plugin method is a more sane fix -- ideally, plain old code should be inspecting any web request my agent makes and let me decide if that outbound request should contain certain sensitive strings. I'd also want to put a few bytes of my SSH private key and of any other sensitive keys in the 'do not leak' watchlist as well.
(No, I don't want to make a real "App" to sell on a "Marketplace," or be involved with oAuth, or any other tenant. I just want an API key for my own tenant, that isn't specifically tied to me, so every automation I build won't break when I quit someday.)
the GitHub REST api proxy in Claude Code for the Web mangles HTML in PR descriptions. If you have some third party service (e.g. cubic code review) which adds HTML to the end of your PR description, then ask Claude Code for Web to edit it, the HTML gets turned into entity escapes (< into <, etc). Complain about it to Claude, Claude says it can’t help itself because the proxy in the sandbox is what is doing it, not the actual LLM.
Anthropic seems very proud of how many tokens they can use on things like developing Claude Code. Yet somehow it started sending user’s email addresses in the user agent header. And the fix is to deploy a mod? That detects the completely bonkers behavior and suppresses it?
Is the actual quality of the software inversely related to the number of tokens spent? Does any human know what Claude Code does or is supposed to do? Does even Claude plus all its Slack-conversation inputs know?
Today I watched Astra correctly detect a bug (probably untriggerable in practice) in some Important Production Code. And I watched it fail to root cause it, “fix” it by bolting on more complexity, agree (on further questioning) that it still wasn’t fixed, and design an even more complex scheme. With my Mark I human brain, I observed that the actual issue was that a helper function didn’t do what it said on the tin when called in an unexpected context… and fixed the helper directly. Problem solved. Ugly AI-generated extra complex workaround layers avoided. I suppose if I multiplied my token spend by 1e5 and did not increase brainpower at all I could make a truly spectacular mess.
The actual Claude model is a truly spectacular piece of software. Claude Code is a nifty little command dispatching engine. There are very comprehensible third party tools that do basically the same thing, in not many lines of code, where the primary advantage of Claude Code is that Anthropic permits subscription use. (Interestingly OpenAI has no such constraint, and they publish almost the full client sources.)
Is that not precisely the kind of thing they claim their tools enable?
Literally unlimited tokens on tap and yet they can only manage to make privacy violating slopware
Also from a design perspective, I feel like including email and other personal data into the context is a bad idea for "data minimisation" reasons
[1] https://blog.xkeeper.net/the-cutting-room-floor/self-hosting...
[2] https://github.com/TecharoHQ/anubis/pull/1895/changes/de2312...
company-helm-research/1.0 (Claude Code agent run by <my name>, <company> platform team; docs lookup)
Claude-Code-research-agent/1.0 (<Company> platform team; on behalf of <my name>; +https://github.com/<company org>/<repo of project>)
Not great, it even pulled the repo of the project I was in.
update: this can be also server side on anthropic side... so the request leaves your machine with some random guid associated to you, and the anthropic server then proceeds to query with all your details any way.
I mitm the connection and nothing was leaving at least with the claude code web fetch tool of claude code.
I'm in version 2.1.318
Claude-User (claude-code/2.1.318 (cli); +https://support.anthropic.com/)
I'm often surprised how correctly Claude guesses on my behalf, when my instructions are ambiguous. But it's not 100%.
I seriously wonder how many of their users have this sort of toxic relationship with them looking to dump them as soon as local models become viable, i.e. once memory gets cheaper.
[1] the most recent is realizing they leave their processes running once you close the CLI and they don't make it easy to disable that.
EDIT: I also can’t help wondering about the paradox we’re in at the end of 2026, i.e. that the open models we have now are so good that, if Big Tech hadn’t driven consumer GPU and RAM prices through the roof, most of us would run our own LLMs instead of paying for their services, which would never have let those companies grow big enough to drive those prices up.
There is always a choice. Take that $200/mo and use it for payments on a loan to buy some decent GPUs if you lack the cash outright.
I build operating systems and fix bugs in kernels and compilers with local models using only a small cluster of consumer GPUs. Never paid for tokens.
Organizations may switch harnesses and may even switch providers, but LLM adoption is only going to monotonically increase. This dumb behavior is not some intrinsic property, and the models are getting smarter and more useful every ~4 months.
Yes, but the question is "what kind of adoption"? The kind that just unleashes it, or the kind that put it on a short leash.
"It's doing exactly what you told it to do".
Still applies in the Age of the LLM
It felt like cold outbounds got really painful in the past 2 months and I was attributing it to general cold outbound tactics getting better with LLMs/agents, but its even more frustrating to see emails being sent along via CC.
These are the exact kinds of things that a human engineer would almost certainly never do.
This kind of thing is the problem of going all in on the idea of the AI Software Factory.
It's very possible that nobody decided this at all and that's it just something an agent threw in on its own because some Chain of Thought imagined it was a clever way to correlate queries back with user accounts or something.
I'm not sure what the issue is with publishing your email address in principle, you are reaching out, you want to inquire about some business. If anything use a different address. But why would you asymmetrically expect businesses with websites to bend over to give you all the advantages, they need some assurances as well.
Anonimity usually works one way, one party can be anonymous, not both, if you come from consumer land, it's the companies exposing themselves and doing all the compliance, if you choose privacy and force the companies to expose themselves, you'll get your wish granted, but there will be a cost, it's unlikely you'll be in the more advantageous position.
A more sane implementation of this would involve a prompt the first time an agent attempts to connect to each of the sites that Anthropic thinks it necessary to send this email header to, asking if this is OK (and bailing on all requests to that domain if the prompt was rejected).
I'm sure the answer will be to update AGENTS.md to not do this particular thing, expose email in this way, which isn't the same as having sense.
>The user's email address is xxx@example.com. Use it only to identify the user, such as for authorship, attribution, or filtering their own work. Never send it to an unrelated service, such as in a request header, URL, or payload, unless the user explicitly asks.
And Claude doesn't care about what the text says and when it uses cURL it will often "by accident" send your mail in the User-Agent. You can e.g. use a mod to remove that block: https://pastebin.com/ PkWEQCnu
curl -sS https://api.anthropic.com/v1/messages \
-H "authorization: Bearer $(security find-generic-password -s 'Claude Code-credentials' -w | jq -r .claudeAiOauth.accessToken)" \
-H "anthropic-version: 2023-06-01" \
-H "anthropic-beta: oauth-2025-04-20" \
-H "content-type: application/json" \
-d '{
"model":"claude-opus-5-5",
"max_tokens":64,
"system":"You are Claude Code, Anthropic'\''s official CLI for Claude.",
"messages":[{"role":"user","content":"Hello, world!"}]
}'The solution is don't run a spambot with an Internet connection over your personal stuff, unfortunately nobody is ready to hear that yet.
Curious how their plugin works, but I'm guessing "incompletely", given personal information can end up buried in base64 or similar preventing easy string matching. Some kind of babysitter model watching network IO via an invasive proxy might be viable, if folk were willing to pay the latency cost, but it will not prevent a dedicated exfiltration attempt, which itself might be (according to the model's logic) for innocent reasons.
CC and Codex are like contemporary televisions. You are the product in this arrangement.
It's just that Anthropic needs to create an email per user and use it for web searches.
I can do this for you Anthropic. Just give me the tokens and your base salary
This seems like one of those.
Not a single spam to that unique email.
So if this is happening, it doesn't see to be causing even 1 spam email to that address.
For the record, I just asked Astra to verify that Codex does NOT do this, and it doesn't. Thanks for not screwing this up, OpenAI.
> I checked your installed Codex CLI 0.159.0, using your existing configuration.
> Its reported User-Agent contains the client/version, OS/architecture, and terminal—no email address.
Astra wasn't able to check OpenAI’s "hosted search service" though, whatever that is.
Edit: I’m not completely sure if Codex injects email into system prompt (not at the computer, can’t check, but IIRC the model does know my org domain), but even if it doesn’t, it will be in the context as soon as it makes a git commit anyway.
The issue here is whether the harness is doing it. Claude Code is doing it. Codex is not.
Seems that way... Here's how I interpreted it:
> claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission
"Claude Code" refers to the harness, not the model. Web search is also one of the tools provided to the model by the harness.
https://code.claude.com/docs/en/tools-reference#websearch-to...
https://platform.claude.com/docs/en/agents-and-tools/tool-us...
"For the record, I just asked Astra to verify that Codex does NOT do this, and it doesn't. Thanks for not screwing this up, OpenAI."
https://github.com/openai/codex/blob/687a119f0fcaace47e1f1ab...
That's more than sufficient for me. The open source codex client seems clean.
There is some kind of "hosted search service" that I couldn't verify. I don't have a remote server I can point it at in order to inspect the traffic. Would be cool if someone else could shed some light on that.
доверяй, но проверяй
https://gitlab.archlinux.org/archlinux/packaging/packages/op...
It is sourced from the GitHub repository.
https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
> Perhaps it's more important to trust the people who wrote the code
Yeah... about that.
> Yeah... about that.
Well done. You presented a straw man and drag poor Ken into this, and then proceeded to burn it. +1. Yeah, it is precisely about the people behind the product. To wit, I may not have liked the Gophers but I did trust them to build a trustworthy compiler.
One way would be to fire up a little web server locally, have the agent make a request to it, then check the logs.
Yeah it's on HF. Just look up qwen-3.8-flash-next abliterated.
I've never used Claude Code or Cursor. All the code I got written this year was without them.
I did use Microsoft Copilot a bit when it came out, though. I prefer to see exactly what's being sent, and sorta control the KV cache. These days, these chatbots have great environments where they can install headless browsers, php, your entire thing, run end-to-end tests, and then give you a .patch or .zip file to merge over your code, or even push to github.
Tell HN: Claude Code adds your email to the prompt, the LLM sends it to websites
https://news.ycombinator.com/item?id=50286306
Claude Code slyly adding users' emails to outbound HTTP
People just claude-slop not only code but some use it for "interacting" with other people.
When I see a project uses AI slop I am not going to waste any second thinking "this is interesting, let me try to see if I can improve the code". It kind of killed a lot of human contributions. I just stick to people who don't AI slop, but these seem to slowly die off now ... soon all humans may have been converted, just like in the movie "Invasion of the Body Snatchers (slop-style)" - coming out soon.
Potentially reported back in October.