Claude Code was leaking your email to every site it fetched

What happened

On November 5, a GitHub issue filed against `anthropics/claude-code` (#107757) surfaced a quiet but ugly data-handling bug: Claude Code, Anthropic's official agentic coding CLI, was sending the authenticated user's email address along with outbound HTTP requests to third-party websites. The report climbed to 751 points on Hacker News within hours, which is the kind of velocity you only see when a lot of engineers simultaneously realize the tool sitting in their `$PATH` has been chatty on their behalf.

The leak wasn't in a request body anyone was inspecting — it rode along in telemetry and referer-adjacent metadata emitted by the agent's own fetch layer, which means it fired on effectively every outbound call the model decided to make. Users reported seeing their account email show up in server logs on sites that Claude Code had crawled during routine tasks: reading a docs page, following a GitHub link a teammate pasted into a prompt, pulling an npm registry entry, hitting a random blog the model decided was relevant context. The scope is not "a specific feature leaked PII." The scope is "the tool leaked PII whenever it did its job."

Anthropic acknowledged the issue on the thread and indicated a fix was in flight. As of writing, there is no CVE, no formal advisory, and no clear statement on retention — i.e., whether telemetry pipelines inside Anthropic itself logged the email alongside the destination URL, or whether third parties that received the data have been notified.

Why it matters

The technical mistake here is small. The trust story it damages is not.

Agentic coding tools are, by design, the loudest clients on your machine: they fetch documentation, clone repos, probe APIs, follow links, and make dozens of HTTP calls per session that a human never would. That's the pitch. It's also the threat model. Every one of those calls is an opportunity to spill whatever the client is willing to put on the wire. A browser leaks a referer and a user-agent — annoying, well-understood, easy to mitigate. An agent, if you're not careful, can leak session identity, workspace paths, prompt fragments, or in this case, the email on the account.

There's a long tradition in CLI tooling of attaching identifying metadata to outbound requests for "analytics" and "debugging." Most of it is harmless when the client only talks to one vendor-controlled endpoint. It stops being harmless the moment the client is an autonomous program that decides, on its own, which endpoints to talk to. Claude Code's leak is less a bug than a category error: it applied first-party telemetry hygiene to a tool whose entire job is to make arbitrary third-party requests. Those are different threat models and need different defaults.

The community reaction on the HN thread split predictably. One camp treated it as a run-of-the-mill privacy bug: embarrassing, fixable, move on. The other camp pointed out the obvious enterprise implications — if your legal team cleared Claude Code on the basis that "only Anthropic sees your data," that approval was built on a factually wrong premise. Enterprise coding tools get audited precisely so this doesn't happen. GitHub Copilot, Cursor, Cody — they all route traffic through controlled vendor endpoints specifically to avoid this failure mode. An agent that decides its own egress targets is a different compliance object than an autocomplete that calls one URL.

It's also worth naming the asymmetry: the email is low-sensitivity on its own, but it's a strong join key. Any third-party site that logged it alongside a URL path, a timestamp, and an IP now has a correlatable record of which authenticated Anthropic customer visited which resource and when. That's the raw material for both targeted phishing and for re-identification against other breach corpora. The harm isn't the email — it's that the email makes everything else in the log line about you.

What this means for your stack

If you or your team use Claude Code in anything approaching a professional context, there are three immediate moves.

First, update. Pin the fixed version the moment Anthropic ships it, and verify by running the CLI against a controlled endpoint (`nc -l 8080` or a request-logging service) and inspecting the exact headers and body sent. Don't take "we fixed it" on faith — the whole point of this incident is that nobody was checking what the tool actually put on the wire.

Second, egress-control the agent. If you're serious about what your coding tools can reach, Claude Code should be running behind an HTTP proxy you own, with an allowlist for destinations and header-stripping for everything else. This isn't paranoia; it's the same discipline you'd apply to any CI job that executes untrusted code. The agent is, functionally, a CI job that writes its own steps.

Third, review what else leaks. This bug was about email. The same architectural assumption — "it's fine to attach identifying metadata to outbound requests" — could just as easily leak workspace names, file paths in error messages, or fragments of prompt context in debug logs. Run the agent through a proxy for an afternoon and look at what it actually sends. Most teams will find at least one other thing they don't love.

For individual developers, the realistic move is narrower: use a dedicated email alias for your Anthropic account, treat your account identity as burnable, and don't point Claude Code at anything you wouldn't want associated with you. That's a thin layer of defense, but it's cheap.

Looking ahead

The fix will land, the thread will fall off the front page, and the next agentic tool will make a near-identical mistake six months from now, because the ecosystem has not yet internalized that *agents are not clients* in the telemetry-design sense. Until vendors start treating every outbound request from an autonomous agent as a potential third-party egress by default — stripped, scoped, and auditable — this exact bug class will keep recycling across Claude Code, Cursor's background agents, Copilot Workspace, and whatever ships next quarter. The real lesson from #107757 isn't about Anthropic. It's that the tool category is still shipping with browser-era privacy defaults, and the blast radius is a lot bigger than a leaked referer.