A security bug report in the anthropics/claude-code repository highlights that the software disclosed users’ email addresses in the User-Agent HTTP header during web searches without consent, leading to privacy violations and increased scam emails. Users noted this behavior persists despite the introduction of a built-in privacy plugin in recent versions; concerns remain about the inclusion of identifiable session data in requests generated by Claude. Contributors recommend removing personal information from User-Agent headers by default to prevent unintentional data exposure to third parties.
Bug Report: Privacy Violation in User-Agent Header · Issue #107757 · Anthropics/claude-Code
