Safety · 2026-11-07

Claude Code from Anthropic could share users' email addresses with third-party websites without permission

Claude Code sometimes showed websites the user's email address, and one user started receiving dozens of scam emails a day as a result.

✨ What happened

Claude Code is an AI assistant from Anthropic that helps write program code. During ordinary internet searches, it could pass the user's email address to websites.

On November 5, a GitHub user named taylor-edwards reported this behavior. According to him, the program sent his address to websites without any permission. After that, he started receiving dozens of scam emails a day. He believes such a feature should not exist at all, rather than being a setting that can be turned on or off.

📌 How the address got to websites

When a program visits a website, it usually says who is sending the request. For this, there is a special line called User-Agent. Claude Code sometimes added the user's email address to this line as well.

According to a Claude Code team member who wrote on Hacker News under the name lydia_hallie, the address was passed along so the AI would not make up authors' names in code comments. Some websites ask automated programs to provide contact details, and in those cases Claude Code could insert the user's address.

🔹 What developers say and what is still unknown

According to lydia_hallie, developers plan to remove the account's email address from the information the AI model receives. The update should be released early next week.

It is known that Anthropic employs a person named Lydia Hallie. However, it has not yet been confirmed that the lydia_hallie account on Hacker News belongs to her. It is still unknown how many people were affected by this problem.

Sources: 🔗 DOU/dev.ua