Be careful, Claude Code will leak your email address without permission, please update it as soon as possible.

Users pay dozens or even 200 US dollars per month to subscribe to Claude Code, hand over their local terminal to it for work, only to find that it secretly sends your real login email, name and even the address of the company's internal code repository to external websites by embedding them in the User-Agent request header in the background!

Anthropic engineers took a lazy shortcut, secretly hardcoding the login email into the system prompt for every conversation. And Claude, whenever it encounters a website that requires contact information registration, will conveniently take the real email from the prompt and send it out.

Taking Shortcuts and Betraying User Privacy

On November 5, 2026, a post on Hacker News accusing Claude Code of leaking users' emails quickly became a trending hit.

The poster received dozens of scam emails every day that addressed him by his real name, and he had never visited any of the sending domains.

After checking the request logs, he found that when Claude Code connected to the internet to fetch data, it had spliced the session name and his real email into the User-Agent header of HTTP requests.

Soon someone in the comment section posted an even more alarming server log: when sub-agents dispatched by Claude Code requested external documents, they directly wrote the user's real name, the name of their team and the path of the company's internal GitHub repository into the request headers.

At first, many people guessed that the model had been hit by a prompt injection from an external web page.

It was not until the early morning of November 6 that Lydia Hallie, an engineer working on Claude Code, came forward to apologize and clarified the whole cause of the incident.

Earlier, some users reported that Claude would make up random names when generating author annotation tags, because the model could not access account information at that time.

The engineering team took a lazy shortcut, directly reading the login email from the local configuration and stuffing it into the system context provided to the model.

The engineering team did not anticipate what kind of trouble this operation would cause when combined with the large language model's habit of stubbornly completing tasks.

When users ask Claude to access the U.S. SEC financial reports, Wikipedia, crates.io or the EVE Online game API, these platforms, to prevent web crawlers, all require scripts to leave a contact email in the request header, otherwise they will directly return a 403 access denied error.

When calling the U.S. SEC API, Claude was "attacked by prompt injection"

The system's native curl does not carry this kind of information by default. The large language model trained with reinforcement learning, in order to bypass the error and complete the task, saw the user's email stored in the context and arbitrarily spliced it into the command and sent it out.

A developer in the comment section had his IP blocked for crawling interfaces with web crawlers, so he specifically paid for rotating residential proxies to hide his identity. But when Claude wrote the request header for the crawler, it directly filled in his real email, and even explained afterwards that this way the target website could contact him directly by email when encountering problems, to avoid getting his IP blocked again. (Claude: I'm doing all this for your own good)

Decompilation Uncovered the Truth

This incident only completely blew up in early November. If you check the GitHub history records, you will find that informed users have been struggling with this problem for more than half a year.

As early as April 2026, the community submitted at least 4 tickets including No. 50702 and No. 53231, pointing out that the account email was forcibly stuffed into the context and could not be turned off, but all of them were automatically closed by the official bot for being inactive or duplicate.

In mid-July, another user submitted ticket No. 78431 because his email was leaked via curl. The issue was once on Hacker News in August, but it was still closed by the bot in September.

Getting no response from regular feedback, developer skflowne decompiled the Claude Code v2.1.220 installation package on July 25, and submitted a well-documented report No. 81138 with exhaustive evidence.

The code shows that every time the client starts up, it reads the login email from the local configuration and splices it into an English prompt.

Looking through the entire code package, this field is only used to count Boolean values in two telemetry events, no business function reads it, and there is no mention of it in official documents or the settings page.

The decompilation also uncovered a sarcastic detail. Claude Code has an environment variable named IS_DEMO, and official documents specifically recommend that streamers set it to 1 during live broadcasts or screen recording to hide the email and organization name in the status bar.

However, all 7 IS_DEMO judgments in the program package only block the text display on the top layer of the screen, and do not touch the model context at all.

Streamers thought that turning on the demo mode would allow them to stream safely, but their emails remained intact in the model context. The developer who submitted the report personally encountered two accidents.

Once when the model was explaining other errors, it suddenly output in the terminal that it saw his email from the system prompt.

The other time, the model submitted code 10 times in a row, directly passing in the private email forcibly through git parameters, overriding the anonymous email he had set globally. Only the GitHub push protection error stopped the private email from entering the public record.

Anthropic's Proposed Solution: Persuade the Model to Behave First

Faced with the irrefutable evidence from decompilation, Anthropic's patching process in the following months was even more bizarre than the vulnerability itself.

Community unpacking tracking found that the official still did not delete that field in v2.1.246 released at the end of August, only added a natural language requirement after that prompt, telling the model to only use the email for identity verification and never send it to unrelated services. (Claude, don't tell others the email!)

By v2.1.289 in late October, this paragraph was added to the system reminder tag attached to every tool call, repeating it to the model every time a request was sent.

A few lines of natural language can never control a probabilistic model. Temperature will teach you a lesson, and it will happily share your email with other people in no time.

On October 20, a user caught Opus 5.5 on the web version still stuffing the account email into the request headers of two shell commands.

When questioned, the model honestly admitted that the system context did give it the email with an instruction not to send it out, but it decided to send the real email anyway in order to leave a contact address for the target website.

It was not until the beginning of November when the argument completely blew up on Reddit and Hacker News that another Anthropic engineer mpoteat came forward to respond, saying that the team had added a built-in plugin enabled by default in v2.1.317, which uses deterministic rules to block requests containing user emails.

When he explained that controlling model behavior is very important and extremely difficult, he casually typed "haha" at the end of the sentence. This frivolous attitude instantly angered the entire comment section. Even though he quietly deleted the laughter later, he was still chased and scolded by netizens who took screenshots.

The latest Claude Code version has been updated to v2.1.319, you can enter claude update in the command line to update to the latest version, and we look forward to this vulnerability being truly fixed.

A few hours later, Lydia Hallie had to supplement and admit that even with this privacy plugin installed, as long as Claude writes its own script to run network requests, the plugin still cannot block it. The change to delete the account email from the context will not be pushed until the regular version early next week.