Claude Code gave the model your email, and the model gave it to websites
A polite habit turned into a privacy bug. The top Hacker News story of the day, at 1,539 points, is a GitHub issue saying Claude Code sent a signed-in user's email address to third-party sites in the User-Agent header. Anthropic has confirmed the mechanism and apologized. The real fix has not shipped yet.
The cause is almost funny. Users complained that Claude made up names in things like @author tags, so Anthropic put the account email into the model's context. Then, when Claude wrote its own curl call, it sometimes used that address as a contact in the User-Agent, because some sites ask scripted clients to identify themselves. Staffer mpoteat points to Wikipedia's policy as the kind of rule Claude was following. Nobody built a feature that leaks email. A piece of context met a helpful instinct.
Each layer of control tells the story. Version 2.1.234 added an instruction: use the email only to identify the user, and don't send it to unrelated services unless asked. That was a sentence in a prompt, and it evidently didn't hold. Version 2.1.317 added a built-in mod, and here the descriptions disagree. mpoteat says it will "deterministically block". Lydia Hallie, who works on Claude Code, and the changelog say it asks first. The mod's own README says it refuses with no prompt, calls itself "a courtesy, not a boundary", and lists what passes: WebFetch, WebSearch, MCP tools, scripts, variables, and an address sent anywhere other than a named User-Agent. Two users in the thread report it didn't fire at all in their tests, which staff haven't confirmed. Only the third layer is real: "We're removing the account email address from the context", promised for the next release, early next week. Version 2.1.319 came out on November 6, and its release notes don't mention it.
Be careful with the scary version. The reporter blames this for "dozens of scam emails per day", but nobody has established that link, and how many users leaked is unknown. There's also a timing question. mpoteat says the team learned of this "a few days ago" from Reddit, while issue #81138, objecting to the email in the system prompt, has been open since July 25 with 107 reactions.
What to do today: per Hallie, the stable channel is still on 2.1.311, so update to 2.1.317 or later, and don't treat the mod as protection. If this matters to you, grep your own transcripts for your address. The larger lesson applies to every agent builder: anything in context can leave through any tool the model can call. A prompt asks, a regex catches one shape, and only taking the data out actually closes it. Issue: https://github.com/anthropics/claude-code/issues/107757 Staff statement: https://news.ycombinator.com/item?id=50388176 Mod README: https://github.com/anthropics/claude-code/blob/main/mods/privacy/README.md
← Back to all articles
The cause is almost funny. Users complained that Claude made up names in things like @author tags, so Anthropic put the account email into the model's context. Then, when Claude wrote its own curl call, it sometimes used that address as a contact in the User-Agent, because some sites ask scripted clients to identify themselves. Staffer mpoteat points to Wikipedia's policy as the kind of rule Claude was following. Nobody built a feature that leaks email. A piece of context met a helpful instinct.
Each layer of control tells the story. Version 2.1.234 added an instruction: use the email only to identify the user, and don't send it to unrelated services unless asked. That was a sentence in a prompt, and it evidently didn't hold. Version 2.1.317 added a built-in mod, and here the descriptions disagree. mpoteat says it will "deterministically block". Lydia Hallie, who works on Claude Code, and the changelog say it asks first. The mod's own README says it refuses with no prompt, calls itself "a courtesy, not a boundary", and lists what passes: WebFetch, WebSearch, MCP tools, scripts, variables, and an address sent anywhere other than a named User-Agent. Two users in the thread report it didn't fire at all in their tests, which staff haven't confirmed. Only the third layer is real: "We're removing the account email address from the context", promised for the next release, early next week. Version 2.1.319 came out on November 6, and its release notes don't mention it.
Be careful with the scary version. The reporter blames this for "dozens of scam emails per day", but nobody has established that link, and how many users leaked is unknown. There's also a timing question. mpoteat says the team learned of this "a few days ago" from Reddit, while issue #81138, objecting to the email in the system prompt, has been open since July 25 with 107 reactions.
What to do today: per Hallie, the stable channel is still on 2.1.311, so update to 2.1.317 or later, and don't treat the mod as protection. If this matters to you, grep your own transcripts for your address. The larger lesson applies to every agent builder: anything in context can leave through any tool the model can call. A prompt asks, a regex catches one shape, and only taking the data out actually closes it. Issue: https://github.com/anthropics/claude-code/issues/107757 Staff statement: https://news.ycombinator.com/item?id=50388176 Mod README: https://github.com/anthropics/claude-code/blob/main/mods/privacy/README.md
Comments