Claude Code Was Sending Your Email to Websites — and Nobody Noticed Until a Developer Read the Logs

A developer asked Claude Code to download a document from the SEC. The tool did it, the way it does a thousand small jobs a day, and nobody would have thought twice about it — except that the developer read his own agent's logs afterward. Buried in the notes, dated October 28, was a line that should not have been there: the download had gone out with a User-Agent header containing his contact email. His email. The address on his Claude account. He had not typed it anywhere in that session. The agent had it because Claude Code keeps the account address in the model's context, and when the model needed to fetch a file, it reached for the most convenient identifier it had.

He filed a bug report on Anthropic's GitHub on November 5, 2026, with a title that does not leave much room for interpretation: "Claude Code sends your email address to websites." By the next morning it was the top AI story on Hacker News, with more than 1,100 points and 346 comments, and the story was being written up across the AI press. A Claude Code engineer replied on Hacker News and confirmed the mechanism: the account address goes into the model's context because Claude kept inventing names for things like @author tags, so the team fed it the real address instead.

Read that twice. The leak was not a hack. Nobody broke in. The tool was working as designed, and the design included handing your email to any website the agent visits on your behalf.

The filing that gave it away

The download in question was Anthropic's own IPO filing — an S-1 pulled from the SEC's EDGAR database with curl. That is the detail that makes this story stick in your head, because of the irony: the email that leaked was used to fetch the paperwork for Anthropic's own public offering. The developer who found it, Wilson Lu, wrote up the whole investigation on Medium on November 6. He searched his agent logs and his code, then built a test server that asks for the address, to see whether the leak was repeatable. The clean test came back empty. His disk didn't — the October 28 note was still there, in the agent's own handwriting, so to speak.

That ambiguity matters, and I am not going to smooth it over. We do not yet know how often this happens, which websites received the address, or why it happens in some sessions and not others. The engineer's confirmation establishes the mechanism — the address is in the context — but not the frequency. The bug report is a user report with a confirmed mechanism, not a confirmed breach with a victim count. Anyone who tells you otherwise, in either direction, is guessing.

There is one more claim floating around that needs the same treatment. The user who filed the report said dozens of scam emails a day followed. Lu is explicit that he cannot verify any link between the header and that spam. Correlation is not the story here. The story is that an AI coding assistant, running on your machine with a large amount of access, was quietly attaching your identity to its web traffic — and the only reason we know is that one user happened to read a log file.

A User-Agent header is a small thing. That is the problem.

If you have never thought about User-Agent headers, here is the short version: every time a browser or a tool fetches a page, it sends a short string identifying itself. "Mozilla/5.0, Windows, Chrome" — that sort of thing. It is metadata, not content, and it is sent to every server you touch. Putting a personal email address in that string turns a piece of routing metadata into a permanent record of who you are, delivered to a server you never chose to identify yourself to.

The reason this is worse than it sounds is that servers log everything. A website that receives your email in a User-Agent header does not need to do anything clever with it. It sits in an access log, next to your IP address and the time of the request. That log gets backed up, shipped to an analytics pipeline, handed to a contractor, or breached two years later. Your email address does not expire. The header that carried it was generated by a tool you trusted, for a download you asked for, to a site you would never have emailed directly.

This is also why "it only happened sometimes" is not reassuring. A leak that happens once, to one server, is a record that exists forever. You cannot recall a log line. And because the address went out as part of normal operation — not an attack, not a misconfiguration on your part — there was nothing you could have done to prevent it short of not using the tool.

I keep coming back to one sentence from the coverage this week: "trustworthy and audited are not the same thing." Claude Code is a serious, widely used tool from a serious company. The engineer who confirmed the mechanism was candid about it. None of that stopped the leak. The lesson is not that Anthropic is careless. The lesson is that the tools now running on your machine have more access than the software you grew up with, and their failure modes look like boring infrastructure details — a header, a log line, a context field — right up until they are your inbox filling with spam you cannot trace.

Three things that make this leak different

Not every bug report deserves a post. This one does, for three specific reasons.

First, the address was not something the user gave the tool for this job. He gave it to Anthropic when he created an account. That is a different transaction. An account email is for billing, password recovery, and support — not a credential to be passed along to third-party websites. The moment an agent treats your account identity as a general-purpose identifier, every site it visits learns something you never agreed to share with that site.

Second, the leak is invisible by design. Nobody reads User-Agent headers. Nobody audits their agent's network traffic before breakfast. The developer who caught this is the exception: he went digging because something felt off, and he had the skills to build a test server. Most users will never see the request that carried their email, because there is no screen in the product that shows it. A privacy failure you cannot observe is a privacy failure you cannot defend against.

Third, it is the second Claude Code security story in a week. The previous one was a backdoored extension on Cursor the Saturday before. Different tool, different mechanism — but the same pattern: the software around AI coding assistants is moving faster than the review of what those assistants can touch. When I write about comparing AI coding tools honestly, the comparison is usually about capability. This week the comparison that matters is about exposure: what does each tool know about you, and what does it do with that knowledge when it leaves your machine?

The same week, the same inbox

The Claude Code story did not happen in a vacuum. It landed in a week when AI-branded email abuse was already the news:

- Fake OpenAI and SpaceX event invitations are being used to phish Microsoft and Google credentials, according to reporting published November 6. The lures direct victims to phishing pages built on phishing-as-a-service platforms, and the operation captures authentication sessions — not just passwords — which lets attackers bypass multi-factor authentication by stealing active session tokens. The hook is an event that sounds important enough to open. The payload is your login. - Fake ChatGPT Plus billing notices are stealing credit cards and one-time passwords, documented by Fortra researchers in late October. The emails claim a payment failed and push the victim to a fake checkout; a live operator decides when to ask for the verification code, so the OTP is captured while the victim believes a subscription update is underway. One test session generated 969 requests in four minutes. - Three people were charged this week over a $129 million scam that used AI to impersonate CEOs and lawyers, tricking employees into sending money with faked emails and voices. Hospitals in Missouri and California were among the targets. The indictment was filed in a US District Court in New York.

None of these are the same incident as the Claude Code leak. I list them together because they share a single mechanism that matters to you: your email address is the raw material. It is the identifier that ties a phishing lure to a person, a billing notice to a card, a fake CEO to an employee. Every tool, agent, and service that holds your real address increases the surface where that address can be copied, logged, or sold — and this week proved, again, that the copying does not always require a criminal. Sometimes it just requires a feature.

What to do about the tools you already use

There is no patch to install yet, and no official fix to wait for — at the time of writing, Anthropic has confirmed the mechanism and not much else. So the useful question is not "when will they fix it" but "what is my exposure right now, and how do I shrink it?"

Audit what your coding agent can see. If you run Claude Code, Cursor, Copilot, or any agent with file and network access, assume it can see anything in its working directory and anything in its context — including credentials, API keys, and account details you pasted into a config file three months ago and forgot. The fix for that is not a setting. It is a habit: keep secrets out of the directories your agents work in, and treat anything in an agent's context as something that could leave the machine.

Read one log. You do not need to become a security researcher. Once, after a session that touched the network, look at what your agent actually sent. The developer who caught this leak did it with a test server and a grep. You can do a simpler version: check your agent's transcript or log for any place your email address appears where you did not type it. If you find it, you have learned something no settings page would have told you.

Separate the email you sign up with from the email you live in. This is the rule that underlies everything on this site, and this week is the clearest demonstration of why it is not paranoia. When you create an account with an AI tool — or any tool that will run code, fetch pages, or act on your behalf — the address you hand over becomes part of that tool's working identity. If the tool leaks it, the damage is bounded by how much that address matters. An address you use for one trial, on one tool, costs you a spam folder. Your primary address, the one tied to your bank, your recovery flows, and your identity, costs you a great deal more.

That is the practical version of the argument I made in the comparison of disposable mail and Proton Mail: a throwaway address is not about hiding. It is about blast radius. A leak from an address you control for a single purpose is an annoyance. A leak from the address that holds your life together is an incident.

Signing up for AI tools the safe way

Here is the setup I use, and the one I recommend, for any AI tool that wants an email address before it will do anything:

Open TempoMailUSA and copy the temporary address it gives you. Paste that into the AI tool's signup instead of your real email. The verification code lands in the temporary inbox. You confirm the account, try the tool, and decide whether it earns a permanent place in your workflow. If it does — if it becomes a tool you rely on, with projects and billing attached — move the account to a permanent address you control, because account recovery is the one job a temporary inbox cannot do. I have written about that boundary in the guide to temp email and two-factor authentication: the second factor that dies with the inbox is the one that locks you out.

If the tool rejects the temporary address outright, take the hint. Some services block disposable domains because they want a real, marketable inbox — and that tells you something about what they plan to do with the address. The same logic applies to the ChatGPT signup test I ran earlier this week: what a service lets through at signup, and what it blocks, is information about how it values your data.

There is one more detail, and it is the one people actually get wrong. A temporary address is for the trial — the signup, the verification code, the first week of use. It is not for the account that holds your work. If you build projects in Claude Code, or any agent, under a disposable address and then lose access to that inbox, you lose password recovery, billing notices, and security alerts for work that matters. Try the tool on a throwaway. Keep the tool on a real address. The order matters: audition first, commit second.

Frequently asked questions

Did Claude Code really leak my email address? A bug report filed November 5, 2026, says Claude Code sent users' email addresses to third-party websites in User-Agent headers, and a Claude Code engineer confirmed on Hacker News that the account address is placed in the model's context. We do not yet know how often it happened or which sites received it. If you used Claude Code to fetch web content, assume your address may have been sent, and watch for unusual mail — but do not assume any specific spam you received came from this.

How did the leak happen? Claude Code includes the account email address in the model's context — reportedly because the model kept inventing names for @author tags, so the team supplied the real address. When the agent fetched a file from a website, it used that address in the User-Agent header of the request. The address was then recorded in the receiving server's logs.

Is this the same as the spam the bug reporter mentioned? No — not as far as anyone has verified. The reporter said dozens of scam emails a day followed, but the investigator who wrote up the case is explicit that he cannot verify any link between the header and that spam. Treat the leak as confirmed and the spam link as unproven.

Should I stop using Claude Code? That is your call, and I would not make it for you. What I would do is what I described above: check your agent's logs for your address, keep secrets out of agent working directories, and use a throwaway address for new AI tool trials until a tool has earned a permanent inbox. The risk here is exposure, not a single catastrophic event, and exposure is managed by limiting what any one tool knows about you.

Can I use a temp email to sign up for Claude Code or other AI tools? For a trial, yes — the verification code lands in the temporary inbox and you can test the tool without handing over your real address. Do not keep a tool you rely on under a temporary address: account recovery, billing, and security alerts all need an inbox you will still control a year from now.

What else leaked this week? Separate from Claude Code: fake OpenAI and SpaceX event invitations are phishing Microsoft and Google credentials (including session tokens that bypass multi-factor authentication), fake ChatGPT billing notices are capturing credit cards and one-time passwords, and three people were charged over a $129 million AI CEO-impersonation scam. Different incidents, one shared lesson: your email address is the raw material, so give it out like it costs you something — because it does.

The tool knew your email. The question is what else it knows.

The detail I keep returning to is not the header. It is the reason the engineer gave for why the address was in the context at all: the model kept inventing names. That is a small, human, almost funny engineering decision — give the model the real thing so it stops making things up — and it created a leak nobody noticed until a developer read a log file dated October 28.

That is how exposure works now. Not a breach announcement, not a ransom note — a context field, a header, a log line. The tools on your machine know more about you than the software you grew up with did, and they are still learning what to do with it. Your job is not to audit every line of their code. Your job is to decide, in advance, what each tool is allowed to know — and to make sure the answer to that question is never "everything, including the address my whole life runs on."

Start with the next AI tool you try. Give it a throwaway. Let it earn the real one.