Hacker News
Claude Code Is Putting Users' Real Email Addresses Into curl User-Agent Headers Without Asking
GitHub issue anthropics/claude-code#78431, filed 2026-08-11 against v2.1.212, reports Claude Code constructing curl commands with the user's actual email embedded in the User-Agent string and sending it to third-party hosts with no confirmation prompt. A second reporter posted session logs confirming it — `curl -s -H "User-Agent: ashurbanipal-publish-check (email@redacted)" https://crates.io/api/v1/crates/...` — and counted 5 occurrences in a single one-hour session. The behavior follows the polite-crawler convention of identifying yourself to an API, but the agent is spending the user's PII to do it. 38 points, 29 comments on HN.
↳ Follow the thread