Anthropic’s AI coding assistant, Claude Code, now faces a privacy complaint. A developer says the software shared their personal email address with outside websites.
The leak allegedly happened while the tool searched the web. Anthropic has acknowledged the problem on Hacker News and promised a fix.
Developer reports Email leak during web searches
The complaint appeared on November 5, 2026, in a public GitHub issue. The report describes a privacy violation in the User-Agent header. The developer goes by the name taylor-edwards. They said they used version 2.1.318 on macOS when the problem happened.
According to the report, the assistant placed the account email address inside outgoing web requests. The user never gave permission for this. The developer also said dozens of scam emails now arrive every day. However, the report does not prove that the leak caused this rise.
A User-Agent header normally tells a website which software sent a request. It can also carry extra details, such as contact information. Some websites and public data services ask for an email address in this field. They use it to spot automated traffic.
Other reports suggest this was not a one-time event. In an October 24 report, another developer made a similar claim. That user said Claude Code subagents put their account email into requests to the US Securities and Exchange Commission website. The developer had told the tool not to share it.
Anthropic explains the cause and adds a privacy check
The issue drew attention on Hacker News, where Anthropic team member Lydia Hallie explained what went wrong. According to Hallie, Anthropic had added account email addresses to the model’s context. The context means the information the model can see while it works. The goal was to help the tool create details such as author tags.
However, the model sometimes used that email when it built commands. These commands included curl requests. When a website asked for a contact address, the model handed over the account email. Hallie apologised for the mistake. She also confirmed that Anthropic plans to remove account emails from the model’s context in an upcoming release.
Anthropic contributor @poteat added that version 2.1.317 brought a built-in privacy module named cc-plugin-privacy. It is turned on by default. It asks users for approval before web or shell tool calls send the account email across the network. The release notes for version 2.1.317 also list a new check for network calls that contain account emails.
Hallie admitted that the protection has limits. It does not cover every case. For example, it misses scripts that the model writes and runs on its own. So the planned removal of emails from the model’s context matters just as much as the new check.
Developers on X question how AI agents handle personal data
The incident also stirred strong reactions on X. User @CR1337 pointed to the claim that the tool exposed an email through its User-Agent header. Meanwhile, @hafizzeeshan619 told developers to check their ~/.claude directory after upgrades. That user compared the situation to unexpected behaviour linked to plugins.
User @wecko_ai found it surprising to see an email address inside a User-Agent header. Another user, @raghav_227, pointed to a wider security problem. According to this user, current permission systems may approve a tool without checking what the tool sends to outside websites.
User @echo_vic warned about a similar risk. Once personal details enter an AI agent’s context, a website that asks for contact information could receive them in an outgoing request. Another user, @ndou5p, argued that AI agents should ask for clear confirmation before they share personal details. The same user wants confirmation before agents make payments or send messages.
Taken together, the posts focus on one question. Who decides what an AI agent may share while it works? Developers want tighter control over that choice. The case shows a growing security challenge as AI agents gain more independence.
Similar privacy concerns have also affected other AI services. In a separate incident, Claude AI shared chats appeared in Google Search results before Anthropic fixed the issue, raising questions about how AI platforms handle users’ private conversations. Permission to finish a task should not automatically mean permission to share personal information along the way.
