Claude Code users find their email address sent to websites in User-Agent headers
Anthropic says a default privacy mod blocks it
Confirmed
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 2 of 5
- Last verified
- 6 November 2026
Your AI and this story
- GPT-6 Astra189 days after its cutoff
- Claude Opus 5.5128 days after its cutoff
- Gemini 4 Argon219 days after its cutoff
- Grok 4.7158 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 128 days before it.
Key facts
- Issue #107757, labelled bug and area:security
- One user found 53 affected calls across 8 sessions (Aug–Nov 2026)
- Reporter attributes dozens of daily scam emails to it
What happened
See summary.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 reaction
Primary
- GitHub: anthropics/claude-code #107757github.com, code
Reactions
- Hacker News discussionnews.ycombinator.com, discussion
Changes
- Filed