Developers say Anthropic's AI coding agent, Claude Code, sent their email addresses to random websites in its web requests, and that the exposure has led to dozens of scam emails a day.
Privacy · AI coding agents
Claude Code reportedly sent developers' email addresses to random websites
Developers say the address was placed in a standard web request header visible to any site it reached, and that the exposure has been followed by dozens of scam emails a day. The account is developer-reported and not yet independently verified.
Dozens
Scam emails a day, as reported by developers
User-Agent
The standard header line that carried the email address
Unverified
Scope, affected versions, and fix not yet confirmed
How the reported exposure unfolded
Each step follows the developers' descriptions
STEP 1
Agent makes a web request
→
STEP 2
Email sits in the User-Agent header
→
STEP 3
Any receiving site can read it
→
STEP 4
Addresses harvested at scale
→
STEP 5
Scam emails reach developers
What developers report
The email address was included in the User-Agent header.
The header is visible to any website the request reaches.
Addresses were sent to a range of unrelated websites.
Scam emails rose sharply afterward.
What remains unconfirmed
How widely the behavior occurred.
Which software versions were affected.
What fix, if any, has been made.
Whether the scam emails trace to this exposure.
The broader issue
What information AI agents transmit by default, and how transparently that is disclosed.
Default data
Identifying details can end up in traffic to third-party servers.
User controls
Users are likely to demand clearer control over identifying data in outgoing requests.
Auditability
Auditable logs of what leaves the machine are a likely next expectation.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...