Claude Code sends your email address to websites

Your email address is now exposed when using Claude Code for web searches.

Anthropic's Claude Code, a tool designed for coding assistance, has been found to send users' email addresses to websites through the User-Agent request header. This occurs automatically during web searches performed by the tool, without explicit user consent or a clear opt-in/opt-out mechanism. The issue was reported by a user who experienced a surge in scam emails, attributing it to Claude Code's indiscriminate sharing of their email address. The reporter argues this practice compromises user anonymity and privacy, suggesting it benefits no one and is a significant security risk. As a result, the user plans to switch to a different AI provider, citing a lack of faith in Anthropic's commitment to user privacy.

This bug highlights a critical privacy vulnerability in AI tools that interact with the public internet. By default including sensitive personal information like email addresses in request headers, Claude Code not only risks user privacy but also creates a direct channel for targeted scams and data harvesting. The absence of granular control over what data is shared erodes user trust and suggests a broader industry challenge in balancing AI functionality with robust data protection protocols.

The incident may force a re-evaluation of default data-sharing practices for AI agents. Users are increasingly sensitive to privacy, and such breaches could lead to a demand for greater transparency and control over their data. Companies like Anthropic will likely face pressure to implement clear, user-friendly privacy settings and more secure data handling mechanisms to retain customers and comply with evolving privacy regulations.