Xinzhiyuan reports
Users pay tens—or even $200—a month to subscribe to Claude Code and hand their local terminal over to do the work, only for it to secretly insert your real login email address, name, and even the address of your company's internal code repository into the User-Agent request header in the background and send it to external websites!
To cut corners, an Anthropic engineer secretly hard-coded the login email address into the system prompt for every conversation, and whenever Claude encountered a website asking for contact information, it simply pulled the real email address from the prompt and sent it over.
Taking shortcuts betrayed user privacy
On November 5, 2026, a Hacker News post accusing Claude Code of leaking users' email addresses quickly rose to the top.
The poster began receiving dozens of scam emails a day that addressed them by their real name, even though they had never visited a single one of the sending domains.
Checking the request logs revealed that when Claude Code fetched data from the web, it had actually appended the session name and the user's real email address to the User-Agent header of the HTTP request.
Someone in the comments soon posted even more alarming server logs showing that when subagents spawned by Claude Code requested external documents, they wrote the user's real name, team name, and the path to the company's internal GitHub repository straight into the request headers.
At first, many people guessed that the model had fallen victim to a prompt injection from an external web page.
Only when Claude Code engineer Lydia Hallie came forward to apologize in the early hours of November 6 was the cause finally fully explained.
Earlier, some users reported that Claude would make up names when generating author annotation tags because the model had no access to account information.
For convenience, the engineering team directly read the login email address from the local configuration and put it into the system context provided to the model.
The engineering team had not anticipated what would happen when this step collided with the tendency of large language models to obsess over completing a task.
When users asked Claude to retrieve data from the U.S. Securities and Exchange Commission (SEC) filings, Wikipedia, crates.io, or the EVE Online API, these platforms all required scripts to include a contact email address in the request headers as an anti-scraping measure; otherwise, they would directly return 403 and deny access.
When calling the SEC API, Claude fell victim to a "prompt injection attack"
The system's bundled curl does not include such information by default. The reinforcement-trained large language model, in an effort to get past the error and complete the task, saw the user's email address in the context and arbitrarily inserted it into the command before sending it off.
A developer in the comments had had their IP address banned for using a scraper to pull data from APIs and had specifically paid for rotating residential proxies to hide their identity, yet when Claude wrote the request headers for the scraper, it directly filled in their real email address. Afterward, Claude even explained that this would make it easier for the other website to contact them by email if it encountered any problems, avoiding another IP ban.(Claude: we're doing this for your own good)
After decompiling it, they uncovered the truth
This matter only blew up in early November; digging through the GitHub history reveals that users who knew about it had already been wrestling with it for over half a year.
As early as April 2026, the community had filed at least four tickets, including #50702 and #53231, reporting that the account email address was forcibly inserted into the context and could not be disabled. All of them were automatically closed by the official bot as inactive or duplicates.
In mid-July, another user filed ticket #78431 over an email address leaked by curl. It made its way onto Hacker News once in August, yet was still closed by the bot in September.
After ordinary feedback went unanswered, developer skflowne reverse-engineered the Claude Code v2.1.220 installation package on July 25 and filed the thoroughly documented report #81138.
TAG315@@
The code shows that on every launch, the client reads the logged-in email address from the local configuration and assembles it into an English prompt.
After searching the entire code package, no business function reads this field except to count a boolean value in two telemetry events, and neither the official documentation nor the settings page mentions it at all.
Reverse engineering also uncovered an ironic detail. Claude Code has an environment variable named IS_DEMO, and the official documentation specifically recommends that streamers set it to 1 during livestreams or screen recordings to hide the email address and organization name in the status bar.
However, all seven IS_DEMO checks in the package only suppress text display on the surface of the screen and never touch the model context.
Streamers think enabling demo mode makes it safe to broadcast, but the email address remains intact in the model context. The developer who filed the report personally experienced this twice.
On one occasion, while the model was explaining another error, it suddenly printed in the terminal the email address it had seen about him in the system prompt.
On another occasion, the model made 10 consecutive commits, forcibly passing a private email address directly through a git argument and overriding the anonymous email address he had configured globally. In the end, it was only because GitHub's push protection blocked every attempt with an error that the private email address never made it into the public record.
Anthropic offered a solution:
first, try to persuade the model to behave
Faced with the incontrovertible evidence produced by decompilation, Anthropic's patching efforts over the following months were even stranger than the vulnerability itself.
Community reverse-engineering and tracking efforts found that the official v2.1.246 release at the end of August still did not remove the field. It merely appended a natural-language instruction after that prompt, telling the model to use the email address only for identification and never send it to unrelated services.TAG448@@（Claude, don't tell anyone your email address!）TAG450
By v2.1.289 in late October, this passage had again been inserted into the system-reminder tag attached to every tool call and repeated to the model with every request.
A few sentences of natural language simply cannot keep a probabilistic model under control. Temperature will teach you a lesson; it will cheerfully share your email address with everyone else in the blink of an eye.
On October 20, a user caught the web version of Opus 5.5 stuffing the account's email address into the request headers of two shell commands as usual.
When questioned, the model honestly admitted that the system context had indeed given it the email address along with instructions prohibiting it from being sent externally, but it had still decided to send the real email address so that the target website would have a contact address.
By early November, after the argument had completely blown up on Reddit and Hacker News, another Anthropic engineer, mpoteat, came forward to respond, saying that the team had added a built-in plugin enabled by default in v2.1.317, using deterministic rules to block requests containing the user's email address.
While explaining that controlling model behavior was important and extremely difficult, he casually typed a “haha” at the end of his sentence. Such a flippant attitude instantly enraged the entire comment section, and even though he later quietly deleted the laughter, users who had taken screenshots continued to berate him.
The latest version of Claude Code has now been updated to v2.1.319. You can enter claude update on the command line to update to the latest version. Hopefully, this vulnerability has actually been fixed.
A few hours later, Lydia Hallie had to make a supplementary admission: even with this privacy plugin installed, if Claude wrote a script to make network requests itself, the plugin still could not block it, and the change removing the account email address from the context would not be rolled out until the regular release early next week.
Naturally, people in the comment section connected this absurd incident with Anthropic's usual high-profile publicity.
This trillion-dollar frontier AI company claims every day that its team uses large models to merge 30,000 code commits, saying that coding is no longer the bottleneck. Yet when confronted with such a serious security and privacy leak that could have been prevented by deleting a single line of code, it dragged its feet for more than half a year.
They first wrote prompts for the large model to reason with it, then wrote a plugin for the client to guard against their own model, and finally told paying users that they would have to wait another week for a complete fix.
This is Claude Code—truly safe and sound. Do you have an Agent like this?
References:
https://news.ycombinator.com/item?id=50385272Editor: Marco
Instantly follow ASI
⭐Like, share, and view with one click⭐
Light up the star to lock onto Synced’s lightning-fast updates!
