User says Claude Code sent his email address to websites

A user says Anthropic's AI coding assistant, Claude Code, sent his private email address to websites while doing ordinary web tasks. Tyler Edwards filed the complaint on GitHub on November 5, 2026, as issue 107757. He says dozens of suspicious scam messages arrived each day afterward. No one has proven the two are connected, and the issue is still open.

What is alleged

Claude Code is a tool that helps people write software and can run commands and search the web for them. Edwards says it added his account email to the User-Agent header of outgoing web requests. That header is a short label software sends to a website to say what program is calling. Any site that receives it can read and store what is in it.

He says he saw this on Claude Code version 2.1.318, running in a tmux terminal on a Mac. He wants the behavior ended for good, not hidden behind a setting, because he argues an email address should never be sent that way.

A privacy feature in doubt

A commenter named Poet said versions 2.1.317 and later include a module called cc-plugin-privacy. It is reportedly on by default and can be turned off with a plugin command. But Edwards was already on 2.1.318 when he reported the problem.

Other developers in the thread were skeptical. Some said the module did not show up on their machines. Others ran tests where commands involving email addresses and User-Agent settings ran with no warning. Those tests did not show that private data actually reached outside servers.

What is not known yet

• Whether the email was really sent out, since there is no full technical trace.
• Whether it caused the scam messages, which is unproven.
• Whether other Claude Code users are affected, since there are no steps to reproduce it.

What happens next

A person described as an employee connected to Claude Code reportedly said Anthropic plans to remove user account emails from what the AI model can see in an upcoming release. That would address the problem at its source rather than with a quick patch. No release date was given in the material reviewed.

For now, the case is a reminder that AI tools that browse and run tasks for you can pass along details you did not expect. It is worth checking which personal details such tools can see, starting with your email address.