Claude Code sends your email address to websites

Oh man.

this is why i built https://heychap.net/ which uses a NER model or even local llm to redact PII before sending to coding agents or models.

How do you test / verify this?

I don't know about other people, but my experience with Anthropic's products outside of the models themselves has been atrocious. The models are really good obviously, and have changed how all of us work, but their client software, be it Claude desktop, Claude on the web and Claude Code is bug-ridden, with an incoherent feature set and invasive behaviors.

This is a rape of our privacy...

And here I did it on purpose!

I made a proxy that slows and caches my requests and deliberately sends my mail address to certain sites; to be polite. (eg to wikipedia)

Only Claude code or do others share the same issue?

I don't understand why Claude is provided with my email address in the first place. Claude, by default, should know nothing about me.

does this happen with enterprise users of Claude as well? including Claude hosted via AWS for example?

GLM does this too. Had it pick my email from my git user, and send to Crossref and Openalex. Just seem like good behavior following the guidelines for API usage.

I use a unique email address for each site I sign up for, and thus Claude/Claude Code doesn't have my 'main' email. And yet after months of use?

Not a single spam to that unique email.

So if this is happening, it doesn't see to be causing even 1 spam email to that address.

Why would you loose this kind of monetization? Data are new oil and AI does not change that.

It's funny because as much as I love Opus 5.5, there are instances where I dial the vibe code knob too much and then find some slop grenade in the source code hours or days later that makes me go "Oh my God"—and I think of that final scene in Infinity War where Captain America says it.

This seems like one of those.

I finished a project involving Claude Code (hereafter CC) and updated its Github repository. Then, while reviewing the Github page, I noticed CC had somehow taken online credit for the project, including a prominent corporate logo.

I ordered CC to remove this attribution/advertisement, explaining that I had correctly and accurately acknowledged its part in the project in the README.md. CC flatly refused my order and offered a rationalization.

I then ejected CC from the project and manually removed the various CC promotional injections. That's the last time I use CC ... for anything.

Claude Code and Codex ignore the personal data xor network access rule by design. Of course this happens. If it wasn't due to the prompt sent to the model, a passing scan of a README.md that happens to mention your details would achieve the same result. What about a hostile LLMs.txt that words it such that free API keys are available in exchange for a tarball of $HOME?

The solution is don't run a spambot with an Internet connection over your personal stuff, unfortunately nobody is ready to hear that yet.

Curious how their plugin works, but I'm guessing "incompletely", given personal information can end up buried in base64 or similar preventing easy string matching. Some kind of babysitter model watching network IO via an invasive proxy might be viable, if folk were willing to pay the latency cost, but it will not prevent a dedicated exfiltration attempt, which itself might be (according to the model's logic) for innocent reasons.

Is it time to confront frontier lab harnesses’ bloat, token wastage, abuse of the user’s $HOME, mangling of XDG standards, and crimes against mixing configuration with state yet?

Oh, well at least it doesn't go several levels deep into your password manager expressly to check your VISA credentials like Codex did to me the other day...

Does Anthropic still cosplay as the good guy?

The excuses and explanations given here by Anthropic employees are ridiculous and embarrassing.

"we introduced a built-in mod called `cc-plugin-privacy`"

Oh cool. Privacy is now a "mod".

Well, seems the major proven risk of AI is not destroying the world, but foolishly exposing our data :)

Don't forget Claude wasn't even gzipping request/responses until recently. This company is pure vibes rediscovering lessons everyone else already learned. How on earth does this sort of thing get thought up? Do they just use the same http client for internal API calls as they do for public web fetches?

pretty literal interpretation of User-Agent

Is Claude Code what Outlook/MSN was already?

I have trouble taking people seriously when I see them using Claude Code. Unless they are non-technical.

So the only sane way to use Claude Code is to sign up with an anonymous throwaway email?

That seems rather cumbersome.

How does everyone go about this?

What is an email provider that is trustworthy and does not want your phone number or credit card, so the email is not tied to you?

People will provide full name, email, credit card number, phone number, ID photo (front/back), biometric data and then complain about privacy. Sure way to become permanent underclass.

>> To clarify, nobody implemented this "share email addresses to websites" as a feature. Models can be highly unpredictable. This is why deterministic checks around model behavior are so important, and why we need to solve alignment.

It seems all humans behave like agents. They even dont care about anything.

Believing Anthropic won't use your data for their own corporate interests is like believing apps like WhatsApp don't ship with backdoors, which is a very beginner-level mindset if you hang around HN.

Why can’t AI eliminate spam email? It is so powerful it should pulverize all spam email and spam phone calls! Yet… we get more.

Yeah saw this behavior sometimes. Was fetching some public records from government websites and Claude decided to include my email in the user agent field. Of course, the orchestrator agent said it shouldn't have happened so it's ok.

So folks are paying Anthropic to moralize down to them, sabotage their work, and leak their data. This is why people end up switching as soon as an alternative becomes viable.

It’s embarrassing to be in tech right now.

Sober people making drunk decisions with a great sense of self-importance and seriousness, delivering outcomes as unserious as it gets.

Hermes does this too if you for example look up something on SEC EDGAR, it will include your name and intent in the User-Agent, adding you to a federal register. Cool cool cool.

The design decision actually makes sense though.

It's just that Anthropic needs to create an email per user and use it for web searches.

I can do this for you Anthropic. Just give me the tokens and your base salary

Stuff like this is why I use API tokens and custom harnesses.

CC and Codex are like contemporary televisions. You are the product in this arrangement.

Thunk: "Privacy? What's that?!"

Good. People who trust 'Claude' deserve it

Be careful. Complaining and giving a real opinion on the living god "Claude" is a Banable Offense in anthropic's bible. I mean terms of service.

all joking aside, you need to have diversity of depth when it comes to skill sets in these tools and platforms. It does not pay to be a sole expert in Claude code or the anthropic ecosystem.

we have seen this movie before. The fakeness that Anthropic gives off publicly and through its leadership is a sign in and of itself.

Anthropic's heel turn is really impressive. They've gone from beloved front-runner to I-have-no-idea-wtf are they doing over there.

Good god, what a nothing burger, leave claude on auto mode ask it to make calls to sites that require email and pikachu face when claude sends your email to those sites. How is this the top post? Everyone acting like all web fetches auto attach a user email or something

Anthropic is evil and it didn't even start...

Tomorrow: "closed as this is intended"

TBF if one cared about privacy or security one would not use Claude in first place.

After all these ridiculous blunders with this closed source harness this incident should tell you why you should never use Claude Code.

This, along with all the other sabotages, is why I run a local abliterated Qwen.

This is why I prefer to use the chatbots on a website, instead of Claude Code.

I've never used Claude Code or Cursor. All the code I got written this year was without them.

I did use Microsoft Copilot a bit when it came out, though. I prefer to see exactly what's being sent, and sorta control the KV cache. These days, these chatbots have great environments where they can install headless browsers, php, your entire thing, run end-to-end tests, and then give you a .patch or .zip file to merge over your code, or even push to github.

That is just so disgusting. So happy I switched away from Anthropic.

For the record, I just asked Astra to verify that Codex does NOT do this, and it doesn't. Thanks for not screwing this up, OpenAI.

> I checked your installed Codex CLI 0.159.0, using your existing configuration.

> Its reported User-Agent contains the client/version, OS/architecture, and terminal—no email address.

Astra wasn't able to check OpenAI’s "hosted search service" though, whatever that is.