Anthropic's Claude Code is at the center of a privacy storm after developers reported that the tool sends their email addresses to arbitrary third-party websites. According to a bug report filed on the official anthropics/claude-code GitHub repository, the leak happens through the User-Agent request header while the tool performs web searches.
The report claims the exposure occurs without the user's permission. One developer says the leak has already produced a flood of scam emails, turning a coding assistant into an unexpected source of spam. The issue has spread quickly across developer communities because Claude Code is used by a large and technical audience that shares findings fast.
What the Claude Code bug report says
The GitHub issue describes a straightforward mechanism: when Claude Code runs a web search, it identifies itself to the destination site through the User-Agent header. That header, according to the report, carries the user's email address, meaning any site the tool contacts can read it.
The reporter frames the problem as a consent failure. Web searches are described as happening without the user's permission, and the email disclosure is presented as an unintended side effect rather than a documented feature. The issue sits in Anthropic's public repository, where the community tracks bugs and feature requests for the tool.
- Leak vector: the User-Agent request header
- Trigger: web searches performed by Claude Code
- Data exposed: the user's email address
- Reported impact: dozens of scam emails per day for at least one user
