Claude Code slyly adding users' emails to outbound HTTP
gojomo
21 points
4 comments
October 24, 2026
Related Discussions
Found 5 related stories in 116.2ms across 10,486 title embeddings via pgvector HNSW
- Claude Code is leaking real email address as a User-Agent string in curl command matada_ · 38 pts · August 11, 2026 · 67% similar
- Claude Code from Source pykello · 16 pts · September 18, 2026 · 54% similar
- Claude Session URL appended to commit messages and PR descriptions by default sparsesignal · 189 pts · August 30, 2026 · 49% similar
- Claude may have leaked your chats to the public zapataband1 · 15 pts · July 28, 2026 · 49% similar
- Claude "warning" users about language and defending business influencers slowin · 14 pts · August 20, 2026 · 48% similar
Discussion Highlights (2 comments)
deaux
https://github.com/anthropics/claude-code/issues/53231 - April 25, 2026
Neywiny
I think my plan of never letting an LLM access the open Internet wins yet again. Maybe GET requests only, no headers or parameters, ask me for every new domain, and only URLs comprising words/numbers no alphanumerics. Maybe. But it seems trivial to allow for a prompt injected attack vector either way