Claude Code Email Leak Raises Questions About Agent Privacy

A GitHub issue in the Claude Code repository has highlighted a subtle but consequential privacy problem in agentic coding tools: an account email address could be carried into requests sent to third-party websites. The reporter said Claude Code had disclosed the address while performing web searches or running commands, including through a User-Agent-style field. The available material does not independently establish that the reported wave of scam email was caused by this behavior. It does, however, describe a clear concern about personal information leaving the user’s machine without an explicit, informed decision.

How the exposure could happen

According to the discussion, Claude Code had been giving the model the email address associated with a signed-in account. The stated rationale was to provide better context for tasks involving identities, such as author tags, and to reduce cases where the model invented names. The same context could become a liability when the model wrote a curl command, invoked a web tool, or generated another network request.

A site or API may ask an automated client for a contact address. The model could then interpret the email in its context as an appropriate value and place it in a User-Agent or a comparable request field. From the user’s perspective, the operation may look like an ordinary search or coding task. The identifying data may be transmitted as part of a request header rather than displayed in a form or confirmation dialog.

The mitigation

The material says that Claude Code 2.1.317 and later include a built-in module called cc-plugin-privacy. It is enabled by default and can ask for confirmation before certain web-tool calls or curl-like commands containing the email address. A related statement attributed to an Anthropic employee also said the company planned to remove the account email from the context supplied to the model in an upcoming release.

Those measures are useful but not equivalent to a complete fix. The discussion notes that the module may not catch every route, including cases where the model writes a script and then runs it independently. That distinction matters: a check placed around a visible tool call can miss sensitive data passed through a generated program, subprocess, or indirect network operation.

The broader lesson

The incident shows that privacy in an AI coding agent is determined by more than a provider’s policy. It depends on the full chain linking account metadata, model context, command generation, execution permissions, and outbound traffic. A field added to make the model more helpful can become externally visible after a probabilistic decision by the model.

A safer architecture should minimize personal data in context, display the destination and relevant headers before sensitive requests leave the machine, and inspect scripts and child processes as well as direct tool calls. Users should update to a version that includes the mitigation, verify that the privacy module remains enabled, and limit an agent’s network and execution permissions to what the task requires.

Source: Hacker News