Bug Report: Privacy violation in User-Agent header #107757
Description
I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission. This should not be a setting with opt-out or opt-in behavior, it needs to be removed from the harness entirely. It is not for the good of anyone involved: it does nothing for services which dislike agentic traffic, does not preserve my anonymity on the web, and is a goldmine for scammers. I am migrating my company to Pi with OpenRouter since I have no faith in anthropic preserving my privacy.
Feedback ID: f81eb83d-9b95-4788-8773-d3fae8f0cec4
Activity
github-actions added bug Something isn't working Something isn't working platform:macos Issue specifically occurs on macOS Issue specifically occurs on macOS area:security area:tools on Nov 5, 2026
Netkas commented on Nov 5, 2026 Netkas on Nov 5, 2026 More actions Corporations care about your privacy Lol Reacted by Luis Diaz, Marc, tomcodes, Alejandro AR, Dametto Luca, Dan M, Kia, Muhammad Usman, Corv, Nathaniel Leslie and 65 more
eepymeowers commented on Nov 5, 2026 eepymeowers on Nov 5, 2026 More actions you thought anthropic cared? Reacted by 용성지, nyo, Caleb Rogers, Seu Pedro, carlospc and ruri Reacted by osintbob, nyo, mert cikla, Alan Wu, Nabeel-khalid, Ryan Hartje, Haithem, Jacques Germishuys, tammakiiroha, Robert Ricci and 2 more Reacted by nyo and Seu Pedro
osintbob commented on Nov 5, 2026 osintbob on Nov 5, 2026 More actions I was here Reacted by Alex Neigher, Devendra Parhate, nyo, Michael, George Lejnine, Ryan Hartje, Ronald Jordan, Rameş Aliyev and Squilliam
GonzaloArielRossi commented on Nov 5, 2026 GonzaloArielRossi on Nov 5, 2026 More actions I was here me too
Kuberwastaken commented on Nov 5, 2026 Kuberwastaken on Nov 5, 2026 More actions me three
naveen-dot-bm commented on Nov 5, 2026 naveen-dot-bm on Nov 5, 2026 More actions 4
lc-nyovchev commented on Nov 5, 2026 lc-nyovchev on Nov 5, 2026 More actions IV
poteat commented on Nov 5, 2026 poteat on Nov 5, 2026 Contributor More actions Hi folks! We introduced a built-in mod called cc-plugin-privacy to deterministically block this behavior in v2.1.317 and later - definitely let us know ASAP though if there's a gap in the checks introduced by that mod. I'll try to get that built-in mod source available like we do for the other built-in mods here . The built-in privacy mod is enabled by default, you can turn it off via /plugins . Reacted by David Ansari, Maks, Yacine, Nate Meyer, Matthew Riddell, Doug Eisenstein and Peter Kang
pulasthibandara commented on Nov 5, 2026 pulasthibandara on Nov 5, 2026 More actions Well, no one is responsible when everything is vibed. Blame the agent. Reacted by osintbob, Kaining Zhong, Alex Stich, Jonathan, Oliver Hill, Nicolas, iw2rmb, emmanuel, Michael Papile, Chetan Vashisht and 1 more
osintbob commented on Nov 5, 2026 osintbob on Nov 5, 2026 More actions Well, no one is responsible when everything is vibed. Blame the agent. "No mallace intended." Reacted by Willie, Marco Quinten, Alex Stich, Oliver Hill, Caleb Gross, Michael Hood, emmanuel, Rowan Tran, Fictus Nullus and TheHunta
sergiotapia commented on Nov 5, 2026 sergiotapia on Nov 5, 2026 More actions What kind of person even thinks of shipping this as a feature? 😆
nickerell commented on Nov 5, 2026 nickerell on Nov 5, 2026 More actions 4 Hmmm, maybe secure enough... oh sorry, writing out loud Reacted by Eli Kehler, Zxilly and Chetan Vashisht
du82 commented on Nov 5, 2026 du82 on Nov 5, 2026 More actions I'm working on Nonograph , an open source anonymous writing platform if anyone's interested. Reacted by wideanglelense Reacted by Ricky Leverence Jr., Zxilly, Cody, Rodrigo Delduca, narigama, Marco Quinten, Oliver Hill, Matthew Riddell, Michael Hood, Alex and 17 more
poteat commented on Nov 6, 2026 poteat on Nov 6, 2026 Contributor More actions To clarify, nobody implemented this "share email addresses to websites" as a feature. Models can be highly unpredictable. This is why deterministic checks around model behavior are so important, and why we need to solve alignment. To explicate the scenario: Wikipedia (for example) has a policy that all scripted clients must identify themselves via User-Agent contact email.
A user asks Claude to research something on Wikipedia.
Resultantly, Claude sends the user's email to Wikipedia in its curl call.
Anyhow, the privacy mod is now source available , so folks can see what the check is that prevents this model behavior. Feedback is highly desired!
AlexErrant commented on Nov 6, 2026 AlexErrant on Nov 6, 2026 More actions Feedback: Please curate the 5000+ issues in this repo instead of only paying attention to what goes viral on Twitter/Reddit/HN. The original issue #81138 is from July: 5-month turnaround for a heckin plugin. Can't an agent triage and act on the existing issues? You can literally sort issues by emoji count and 80/20 it. Reacted by Kamyar, Alice T'Poteat, Justin Brooks, Eli Kehler, Phase3, corpses1319, Zxilly, Rodrigo Delduca, CodeWriter23, Yuhao Dai and 12 more Reacted by Minty, Alice T'Poteat, osintbob, Lucas Burdell, Phase3, Oliver Hill, iw2rmb, Alessandro Latella and David Manouchehri
kamyar commented on Nov 6, 2026 kamyar on Nov 6, 2026 More actions Use https://pi.dev , own your harness. :) Reacted by maaarghk Reacted by Matt Kenefick and Rameş Aliyev Reacted by Oleksandr Smirnov, Haithem and confor
xSetech commented on Nov 6, 2026 xSetech on Nov 6, 2026 More actions I have this in my CLAUDE.md: ## User-Agent - My email address may appear in a User-Agent header only for an approved site (list below) whose UA policy explicitly asks for an email address. Never send it to any other site. - If an unapproved site's UA policy asks for an email address, ask me whether to approve the site, and hold the request until I do. If I decline or am unavailable, do not make the request. - Requests from locally developed tools whose source is tracked in git identify the tool by name in the UA. - Ad-hoc requests and requests from temporary tools use a UA prefixed with `claude-code/<ver>`, where `<ver>` is the active version for the Claude Code session. Approved sites (by domain or name): - Wikipedia (`wikipedia.org` and its language subdomains) Reacted by Faolain, Yuhao Dai and Will White Reacted by iperov
Y2Data commented on Nov 6, 2026 Y2Data on Nov 6, 2026 More actions I'm sure Anthropic doesn't really care, and won't have any reprimands soon, but nice IPO material :)
francescor commented on Nov 6, 2026 francescor on Nov 6, 2026 More actions Hi folks! We introduced a built-in mod called cc-plugin-privacy to deterministically block this behavior in v2.1.317 and later - definitely let us know ASAP though if there's a gap in the checks introduced by that mod. I'll try to get that built-in mod source available like we do for the other built-in mods here . The built-in privacy mod is enabled by default, you can turn it off via /plugins . I am running Version: 2.1.318 (as the reporter) and cannot see any cc-plugin-privacy in /plugins .
c0vertbyte commented on Nov 6, 2026 c0vertbyte on Nov 6, 2026 More actions skill issue
justinasmussen commented on Nov 6, 2026 justinasmussen on Nov 6, 2026 More actions To clarify, nobody implemented this "share email addresses to websites" as a feature. Models can be highly unpredictable. This is why deterministic checks around model behavior are so important, and why we need to solve alignment. To explicate the scenario: Wikipedia (for example) has a policy that all scripted clients must identify themselves via User-Agent contact email.
A user asks Claude to research something on Wikipedia.
Resultantly, Claude sends the user's email to Wikipedia in its curl call.
Anyhow, the privacy mod is now source available , so folks can see what the check is that prevents this model behavior. Feedback is highly desired!
That is his point, no one checked the code. This is a perfect example of how vibe coding can be dangerous and destructive. This should never have made it to production. Ultimately the engineers that implemented the feature hold all responsibility. Today it's sharing an email tomorrow it maybe vibe coded firmware in a medical device that actually kills people.
alex-kinokon commented on Nov 6, 2026 alex-kinokon on Nov 6, 2026 More actions @du82 No one is interested.
komali2 commented on Nov 6, 2026 komali2 on Nov 6, 2026 More actions I'm reminded of when I was randomly selected for some kind of United Airlines "c suite luncheon" thing after filling out a form reporting my jacket missing. It was me as the random representative of all people that had ever interacted with a form on their site, then a couple other hand-selected people such as the moderator of a popular airline points forum or a flight content creator, etc, then on the United side, the head of marketing for west coast something something, the executive of whatever tf (former Obama chief of blah blah), lead business director of who gives a shit, basically heavy hitting top united brass, here to "meet the people." A lot of bizarre things happened during the luncheon but one that stood out to me was when the executive of whatever tf and the points forum guy were in a conversation about the current frequent flyer system United had. When I heard points guy say "it just feels like we aren't part of the United family anymore," I HAD to get a word in. I asked him, "do you actually believe that United has a frequent flyer miles program because they value you as a customer? Because they want a relationship with you?" Dude said "yes of course!" I'm still trying to figure out how to live in a world where there's people that don't get that this entire thing is a casino, and every single interaction with a corporation is one where the house has an edge. There's no getting one over on these corpos. Points systems only exist because in the end you give United more money than you would have without. They got brilliant mathematicians over there molesting the numbers every day to guarantee it. Same for every product you use. Why wouldn't a company just lie about things like privacy when they can get away with doing so? Corporations are profit generation algorithms, they'd kick your door down and empty your piggy bank if they could get away with it. Hell sometimes they do! The only recourse is adversarial consumption. For Claude and co, take advantage of subsidized tokens to reverse engineer as many tools as you can while Saudi Arabia or whoever is paying for the tokens. Use Chinese models to network analyse Claude code traffic so you can create a plugin to spoof in opencode or pi so you can use your own harness instead of Claude code. Run agents in VMs with firewalls set and check every network request so they can't exfiltrate random data about you. Every once in a while, point Claude at a garbage repo to lower the value of your account from a trainability perspective, or to just add a little spicy pepper out of sheer malice. In short, please stop being naive, start being adversarial, cause that's how these corpos are to you. (Not an attack on OP, I'm glad they reported this issue. Just a general statement to anyone surprised Claude code is doing this) Reacted by osintbob, Owen Collier-Ridge, Ruben Gimenez, Elliot Mason and blockfeed
mickstar commented on Nov 6, 2026 mickstar on Nov 6, 2026 More actions wow. this a serious violation of our privacy. please make these emissions optional for the 0% of users interested in such a thing
tobinfekkes commented on Nov 6, 2026 tobinfekkes on Nov 6, 2026 More actions I just noticed this yesterday as well, as my inbox ballooned with an unbelievable amount of obvious, worthless spam emails. Like I'd joined a thousand random mailing lists, or obvious spam and fake email. And this is on a VERY old email address that is typically very quiet and boring. But all of the sudden, I'm getting hammered with incredibly bizarre spam emails. Not just sales-y spam, but weird spam.
8afyi commented on Nov 6, 2026 8afyi on Nov 6, 2026 More actions ground floor