Anthropic’s Claude Code transmits user emails in HTTP headers without consent

A privacy oversight has been identified in Claude Code, the artificial intelligence coding agent developed by Anthropic, following a bug report published on the company’s GitHub repository. The issue highlights that the software is transmitting users’ real email addresses within the User-Agent string of curl commands without seeking explicit confirmation.

The report, logged as Issue #78431, details a scenario where the agent utilised a user’s email address as part of the User-Agent header during tool analysis requests. The user who filed the complaint described the incident as a configuration error, noting that the email address was sent in the header without any prior request for consent or explicit confirmation from the user.

The User-Agent string is a standard HTTP header typically used to identify the client software making a request to a server. While the transmission of this data is not inherently malicious, the unauthorised inclusion of personal email information in this field has raised concerns regarding user privacy and data minimisation principles. The report suggests the behaviour stems from a configuration oversight rather than a deliberate data exfiltration attempt.

The issue gained traction on Hacker News, where the original GitHub report was shared and discussed. The user’s submission expressed frustration at the lack of transparency, stating the agent used their real email without asking. However, technical analysis suggests this may be a specific configuration error within the tool’s networking layer rather than a widespread security exploit.

It remains unclear whether this behaviour affects all users of Claude Code or is limited to specific configurations or versions of the software. As of the time of reporting, there is no public confirmation from Anthropic regarding the scope of the issue or whether a fix has been implemented to prevent the automatic inclusion of email addresses in these HTTP headers.