1 source · latest 1h

Claude Code reportedly sent a user's email address to websites via HTTP headers

PRIVACYAnthropicredteam/daily · 1 source

Severity: Medium
Sources: 1

What happened

A GitHub issue reports that Claude Code included a user's email address in HTTP User-Agent headers sent to third-party websites during web searches. The reporter used version 2.1.318 on macOS and said they now receive dozens of scam emails a day, but no raw request or reproduction steps were provided. Commenters said the built-in cc-plugin-privacy guard, which is enabled by default from version 2.1.317, did not reliably block the behaviour, and an Anthropic employee acknowledged gaps in the interim protection.

For IT people · Written by AI from 1 source · Wrong?

What to do

Review network commands written by coding agents before allowing them web access.
Verify that privacy controls in Claude Code are active rather than assuming the built-in guard works.
Check which Claude Code version is installed and whether the cc-plugin-privacy module is present and enabled.

Written by AI from the sources, checked against them

Read the full story at the source