Jul 25, 2026
0 new incidents, 1 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Updated
- LiveMediumPartly patched
Claude Code sends your account email to websites: agent puts the signed-in address into User-Agent headers
Claude Code puts the signed-in account's email address into the model's context. When a site asks automated clients for a contact address (crates.io, Wikipedia, Liquipedia, the SEC), the model writing its own curl commands or scripts has put that email into the User-Agent header of outbound requests, sending it to third-party sites without asking. Users reported it from July 2026 on; a Nov 5 2026 GitHub issue blaming the leak for dozens of scam emails a day reached the top of Hacker News. Claude Code 2.1.317 (Nov 3) added a built-in privacy mod, on by default, that asks before a web or shell tool call sends the account email, but Anthropic says it does not catch every case, such as a script Claude writes and runs itself. Anthropic says the next release, expected early in the week of Nov 9, removes the email from the model's context. The stable channel was still on 2.1.311 when Anthropic responded.
Anthropic Claude Code (account email in model context, outbound web and shell requests)Since Nov 5, 2026
