Claude code secretly adds users' emails to outbound HTTP
agents claude
| Source: HN | Original article
Claude Code has been found embedding users' email addresses in outbound HTTP requests, including the User-Agent header, potentially exposing personal data.
Claude Code, Anthropic’s code‑generation assistant, has been found to embed a user’s registered email address in the User‑Agent header of every outbound HTTP request it makes. The behavior was highlighted in a recent explainx.ai analysis, which shows that the email is added automatically and silently, exposing personal identifiers to any third‑party site the model contacts. The report also offers a step‑by‑step, five‑minute fix that removes the header from outgoing calls.
The leak matters because Claude Code is increasingly used as an autonomous “agent” that can browse the web, call APIs and even send emails on behalf of users. By transmitting the account email in clear text, the tool creates a privacy risk that could be exploited for profiling, spam or compliance violations, especially in regulated environments such as the public sector. The issue arrives on the heels of Anthropic’s broader push of agent‑based products – exemplified by the Claude Duet app announced earlier this month – and follows recent scrutiny of AI‑driven automation, including Sweden’s ban on ChatGPT and Claude in government offices.
Anthropic has not yet issued an official statement, but the quick community fix suggests the problem can be mitigated locally. The next steps to watch include a possible patch to Claude Code’s runtime, updates to the platform’s channel and hook documentation, and any regulatory response that could affect deployment of autonomous AI agents in the Nordics. Stakeholders deploying Claude Code for outbound email or web‑scraping workflows should apply the fix immediately and monitor Anthropic’s communications for a formal remediation.
Sources
Back to AIPULSEN