Claude Code sends your email address to websites
A GitHub issue in the anthropics/claude-code repository reports that Claude Code, while conducting web searches, sent the reporter's email address to third parties in the User-Agent request header.
Source-based brief · Editor review not recorded · See checks and limits ↓
One primary source; other links are context, not independent corroboration.
- Primary sourceGitHub
- Discovery linkHacker News
A community post points to the original link. Discussion and upvotes do not establish accuracy.
Open full article view →- Community discussion+5
- Fetched source page+30
- No editor link review+0
- Community link+0
This measures the stored source trail and editorial steps. It does not certify accuracy, peer review, or independent corroboration. Popularity adds no points.
View full scoring →Read the scoring rubric →What the source says
A GitHub issue in the anthropics/claude-code repository reports that Claude Code, while conducting web searches, sent the reporter's email address to third parties in the User-Agent request header. The reporter says they received many scam emails afterward, asks that the behavior be removed entirely rather than made opt-in or opt-out, and says they are migrating their company to another tool. The issue is open, with 26 thumbs-up reactions and one comment at the time of capture. The supplied text is a partial page capture that cuts off before the timeline.
Claim explorer
Attribution, source and conditionsSource-stated points from the stored brief. Claim-level assessments have not been recorded.
Source claims not independently checked; the reporter's causal link to the scam emails and the header content itself are unverified, and the captured text is truncated before the full timeline and any maintainer response.
This connects a source, an attributed statement and its qualifications. It does not establish that the claim is correct.
Questions worth asking
Open questions for further reportingWhat remains unconfirmed?
Source claims not independently checked; the reporter's causal link to the scam emails and the header content itself are unverified, and the captured text is truncated before the full timeline and any maintainer response.
What material was available for this brief?
The recorded brief basis is fetched source page. These points are AINewsIQ paraphrases, not quotations or independent confirmations.
The issue reports that Claude Code included the reporter's email address in the User-Agent header during web searches.
Source: GitHub ↗Stored source-based brief · key point 1 · AINewsIQ paraphraseThe reporter attributes dozens of scam emails per day to this and requests removal of the behavior from the harness.
Source: GitHub ↗Stored source-based brief · key point 2 · AINewsIQ paraphraseThe issue is labeled bug and area:security and lists version 2.1.318 on macOS (darwin).
Source: GitHub ↗Stored source-based brief · key point 3 · AINewsIQ paraphraseLimits from the stored brief
Source claims not independently checked; the reporter's causal link to the scam emails and the header content itself are unverified, and the captured text is truncated before the full timeline and any maintainer response.
This is a source-based abstract, not independent validation of the source's claims.
Evidence & sources
These links show where the signal came from and what the source page linked to. A linked page is context, not independent corroboration.
Related archive coverage
These relationships record a citation or topic overlap, not confirmation of the finding.
A community post points to the original link. Discussion and upvotes do not establish accuracy.
Timeline & updates
- Signal dated by source or discovery feed
This timestamp places the signal in the radar. It may be the discovery post date rather than the primary page's first publication date.
- Shared brief stored
AINewsIQ prepared one abstract from fetched source page.
Brief history · 1 retained version
These are changes to AINewsIQ’s own publication. Earlier history is unavailable unless recorded here. Complete retained versions are available to the editor.
- Version 1 · published
Source-based brief stored or updated. This does not establish that the publisher changed its page.
Automated record
Source observations · 1 recent captures
A changed capture means the extracted text differed. It can reflect page furniture or extraction changes; it does not establish a substantive correction. Source captures remain private.
Retained capture; no earlier comparison available.
New engagement snapshots do not mean the source itself changed. Source observations and AINewsIQ brief revisions are separate records.
Why this may matter
If accurate, sending a user's email in request headers exposes personal contact data to arbitrary websites and could enable spam or scams. The report also raises questions about how agentic tools identify themselves on the web.
Limits and open questions
Source claims not independently checked; the reporter's causal link to the scam emails and the header content itself are unverified, and the captured text is truncated before the full timeline and any maintainer response.
Organization-specific financial, security, and operational effects require the organization's own context and review.
Join the discussion
Have a different perspective or a question about the evidence? Discussion is free with a verified email account. Every comment is reviewed before publication.
No published comments yet.
New commenters: 2 submissions per 24 hours, at least 5 minutes apart, until 3 are approved. Discussion guidelines and moderation →