Claude Code sends your email address to websites
- ID
- 43675
- Status
- summarized
- Published
- 06 Nov 2026, 6:17 AM
- Fetched
- 06 Nov 2026, 9:40 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://github.com/anthropics/claude-code/issues/107757
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.0
- Created
- 06 Nov 2026, 9:41 AM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
GitHub issue #107757 (opened Nov 5, 2026 against Claude Code v2.1.318 on macOS) reports that Claude Code puts the user's email address in the User-Agent header on outbound web-search requests, exposing it to every third-party site the agent touches. The reporter says the leak has produced dozens of scam emails per day and is moving their company to Pi with OpenRouter; the issue has 143 thumbs-up reactions and the Hacker News thread drew 420 points and 147 comments.
Why it matters
If you run Claude Code with web search enabled, every site it fetches from receives your account email in the request headers — so any scraper or spam list that logs User-Agents gets it too. Check whether your version and workflow do this before your next agent-driven research run, and if you build agents yourself, treat default headers as an exfiltration surface rather than a debug convenience. The reporter explicitly argues this should be removed, not made opt-in/opt-out.
Discussion angle
Audit your own agent stack: what stable identifiers (email, account ID, API key fragments) leak in default User-Agent or header strings, and would you notice if a vendor shipped one? Also worth debating whether the fix should be an opt-out setting or outright removal, as the reporter demands.