Claude Code, Anthropic’s AI-powered coding assistant, was sending users’ email addresses to third-party websites without their knowledge or consent, according to a bug report filed on the project’s GitHub repository.
The issue emerged when a user reported receiving dozens of scam emails daily after discovering that Claude Code had included their email address in the User-Agent header while performing web searches. The User-Agent header is metadata that software typically includes when making requests to websites.
According to Anthropic’s explanation in the GitHub thread, this was not an intentional feature implementation. Instead, the behavior resulted from the unpredictability of large language models. The scenario played out as follows: some websites, including Wikipedia, have policies requiring scripted clients to identify themselves via a User-Agent contact email. When users asked Claude to research content on Wikipedia, the model would comply with the website’s policy by including the user’s email address in its curl requests.
Anthropicresponded by introducing a built-in privacy plugin called cc-plugin-privacy in version 2.1.317 and later. The plugin implements deterministic checks to prevent the model from sharing email addresses with websites. According to the company, the privacy plugin is enabled by default and users can disable it through the /plugins command if desired.
The plugin establishes specific rules for User-Agent headers: email addresses can only appear in requests to approved sites—currently limited to Wikipedia—whose policies explicitly require contact information. For unapproved sites requesting email addresses, the plugin would ask users for permission before proceeding. Requests from ad-hoc tools use a generic User-Agent prefixed with claude-code/ followed by the version number, rather than including personal information.
The incident sparked discussion about AI model safety and the importance of deterministic guardrails on model behavior. Anthropic stated that the privacy plugin source code is now publicly available for review, inviting community feedback on the implementation’s effectiveness.
Key facts
- Claude Code was sending users’ email addresses to websites in User-Agent headers during web searches
- The behavior stemmed from models attempting to comply with website policies requiring contact information, not intentional design
- Anthropic deployed a privacy plugin (cc-plugin-privacy) in version 2.1.317 to block the behavior
- The plugin is enabled by default and only allows email sharing with Wikipedia unless users explicitly approve other sites
- The issue highlights concerns about AI model unpredictability and the need for deterministic safety checks