Stupid me, I thought they somehow had hacked my company database or so... (considering all the cves, attacks happening on a daily basis...).
Claude Code is not sending your email address to websites as a default, or regularly. It is not some automatic header or anything.
Rather, if you are performing certain kinds of research on sites that involves downloading certain kinds of information, like on Wikipedia or the SEC, it supplies your e-mail address when the sites request it as part of their download policy. As part of anti-bot policy. Obviously Claude should have asked for approval first, but Claude isn't out there just spamming your e-mail address in every external request it makes or anything.
Wikipedia and the SEC are not selling your e-mail address to spammers. And these are the two main sites where it has come up.
It is not.
And to be honest, I don't even know which are they!
If I can find out I might be able to share them.
I burnt a few tokens to get some clarity on this (giving HN as source as well, so there is a reference to this thread):
> This doesn't appear to be Claude Code automatically attaching your email address to every outgoing request. The issue is that Claude has access to your account email in its context and can sometimes include it when generating HTTP requests (e.g. "curl" commands).
> Wikipedia and the SEC were mentioned because they explicitly ask automated clients to identify themselves through the "User-Agent" header, often with contact information. Claude may try to comply with those requirements by inserting your personal email address.
> That's why the leak is probably concentrated on sites with these policies, rather than happening on every website. But Wikipedia and the SEC aren't an exhaustive list (the EVE Online API was also mentioned), and there's no technical guarantee that Claude couldn't include the email in requests to other domains.
> The important distinction is that this appears to be model-generated behavior, not a networking layer automatically adding your email to all requests.
> So "most likely Wikipedia and SEC" is a reasonable hypothesis about where the leak is more likely to occur, not a confirmed limit on where your email could have been exposed.
I do see a lot of times curl being used (in Claude). I don't check all the websites being fetched (shame on me!), but your answer doesn't convince me.
My coincidence is clearly not proof. I am just a random online guy so why trust me. I just shared my recent experience. I used extensively copilot until roughly 3 weeks ago (I went all in on Claude, to try it out properly), and that's when I started to see a lot of spam on my work account. Coincidence? Yes. Correlation? Yes. Causation? No. And I personally don't care because I assume my work email account is somewhere to be harvested, but when I then see such a but report, it kind of rang a bell like WTF. I am as careful as possible about the requests I send, but I cannot remove the UA or know everything the harness is doing behind the scenes.
This type of bugs kind of kills the trust in the tooling. On the other hand, we're being told to use more and more such black boxes.
This is an awfully leaky issue.
Usually this is from LinkedIn, GitHub, etc scraping... There are databases where they just guess and verify emails too
The medical world uses the terms indications and contraindications. I think we in IT could do with a similar process/procedure.
For example, my only used by Claude email address doesn't get any spam at all.
It can take a while for spammers to get your address on their list. Generally the amount of spam over time only goes up. Just because there's a correlation doesn't mean there is a causation. Anyone with an email address, including on a custom work domain, has experienced this and Claude wasn't responsible for all email spam lol
Sites aren't scraping their logs for email address in request headers and selling that to spammers. Getting emails to spam is already easy.
I have email addresses I literally don't use to sign up for anything and they still get spam because you can easily guess the address based on first name on LinkedIn plus the company domain. Spam has been a thing since email was invented.
There are numerous confirmed instances of websites asking to put personal information in the user agent string. And people here are downplaying, downvoting, or even denying that this issue exists. I am sick and tired of the relentless grifting that's overtaking the software industry.
> I am sick and tired of the relentless grifting that's overtaking the software industry.
It's only going to get worse especially depending on your definition of grifting in this context. I've been doing this for a long time but these days I don't even write code. I have AI write the code, monitoring the logs, and suggesting PRs. Our users are happy, I'm happy, and we get features out very quickly without any sort of uptick in bugs. Some people consider that grifting but others will just see it as the current state of development. By the way that's the way that things will become more and more over time. It's scary how good AI is at things these days. I was testing it on 3D modeling with Blender yesterday and was blown away.
If that wasn't bad enough, they're stealing and depriving everyone of critical resources like RAM, electricity, natural resources [1], public land, and taxpayer money.
All this for what exactly? Most of this isn't based at all on current demand, but rather the idea that they can make much better use of resources in the future than the people that actually need them right now. Yet, cheerleaders at HN downplay or deny that anything bad is going on.
This is the grifting. They're selling hypothetical demand while robbing everyone else of the actual resources that we all rely on. These companies are acting like the scammers at Wall Street who caused the 2008 financial crisis, except that the scale and scope of the harm is so much worse.
Your argument is akin to the scammers cheering for themselves in the lead-up to the financial crisis. "See? We're making it possible for people to afford homes, but you ungrateful people are calling affordable housing grifting."
That's gross.
Even the Wall Street scammers didn't publicly display this level of arrogance. Because at least, the superficial benefit was affordable housing, not the joy of rich assholes being able to play with their shiny new toy.
[1]: https://www.theguardian.com/environment/ng-interactive/2026/...
Sorry, I don't understand what is the "hypothetical demand" you identified in my comment you replied to? There is real demand for AI. I use it daily for years and my usage has only been increasing as its become more competent and I've learned how to use it better. If you think that is BS and its all hypothetical, you quite simply just don't know what you are talking about.
> Your argument is akin to the Wall Street scammers cheering for themselves in the lead-up to the financial crisis. "See? We're making it possible for people to afford homes, but you ungrateful people are calling affordable housing grifting."
What argument are you referring to? Can you specifically quote what you are talking about that I said because I don't understand. Just seems like you wanted to find a way to bring this back to a previous bubble and call me a scammer simply for not being anti-AI.
I am a heavy user and I checked my logs and never once did it include my email in any sort of web requests. The chance that it actually included that person's email and then that led to them getting spammed is just incredibly low.
98% I look at a LinkedIn profile, my $SALES_LEAD Chrome extension shows me their email + phone.
(To be clear, not from LinkedIn, but given their name/city/company.)