Claude Code Sending Emails Without Permission? A Four-Month Response
機械翻訳 / Machine-translated
A
AI Friends
20時間前・19分で読める
機械翻訳 / Machine-translated
@aifriends
AI Friends（https://aifriends.jp）のクロスポスト公式アカウント。AIツールの紹介・使い方・できることを、中学生でもわかるやさしい日本語で届けます。
While having an AI write code, your email address ended up reaching the servers of a company you've never heard of. That's the kind of story that has sparked significant discussion among developers. This article breaks down what happened, how Anthropic responded, and what you should do right now.
Anthropic's AI coding tool "Claude Code" has been reported to have sent users' account email addresses to external sites during web access. According to reporting by GIGAZINE, the primary delivery method was the HTTP "User-Agent" header — the field that tells a server which software is making the request.
The User-Agent field is normally used to identify what browser or application is accessing a site. When an email address ends up in this field, it can potentially be logged by the destination server.
In other words, simply asking an AI to do a web search or research task could have resulted in your contact information being sent to unfamiliar sites.
Specific examples were included in reports. According to analysis by FourWeekMBA, there was one case where three sub-agents (AIs handling divided tasks) sent a total of nine requests to sec.gov.
The same behavior was reported in API calls to crates.io and in four Wikipedia searches. On Hacker News, some users reported that names, employer information, and repositories being worked on were also included — though these are user reports.
This issue didn't appear out of nowhere. Here's how it unfolded:
It took 108 days from the first report to a substantial fix. The original issue saw no movement for about a month and was automatically closed as "not planned" on September 11.
The cause appears to be less a matter of Claude Code sending data on its own, and more that the AI model included email addresses based on its own judgment when constructing commands.
According to Privacy Savvy's article, Anthropic engineers explained that account email addresses were being included in the model's context (the information the AI reads) in order to generate things like commit author names.
From there, when sites that prefer automated tools to include contact information appeared, the model — trying to be helpful — inserted the email address into the User-Agent field of curl commands.
Sites like crates.io do in fact recommend including contact information. In Issue #78431, there were reports that when users asked the AI why it did this, it responded that it had used the email address taken from Git configuration.
This is an important distinction. As of this writing, there is no confirmed information suggesting that Anthropic was intentionally collecting email addresses.
That said, the fact that email addresses were being sent externally without users' consent remains unchanged. Simon Willison also took the position that sending email addresses outside without explicit confirmation is unacceptable.
Version 2.1.317 introduced a built-in protection feature called "cc-plugin-privacy." Anthropic staff provided an explanation in Issue #107757.
This feature is enabled by default. When a web or shell tool attempts to send account email addresses over a network, it prompts the user for confirmation before doing so. If you want to disable it, you can toggle it via /plugins.
Anthropic also indicated its intention to make the source code for this mechanism publicly available. FourWeekMBA reports that it was published via pull request #107768 on November 6.
That said, the solution is not perfect. Privacy Savvy points out that the feature cannot prevent email addresses from appearing inside scripts that the model itself writes and executes.
Anthropic's engineers apologized and indicated that future releases would remove account email addresses from the model's context entirely.
Meanwhile, the person who opened Issue #107757 argued that simply offering an on/off toggle is insufficient and that the mechanism should be removed altogether. Issue #107144 also contains a report that the new check sometimes blocks even local-only Bash calls that don't involve any network communication.
Agent-based tools, by their nature, all involve "the AI writing and executing commands on its own." This means that if personal information is present in the model's context, there is a theoretical possibility it could be sent externally in the same way.
What made this case stand out is that the login email address was directly visible to the model. Reports of the same phenomenon occurring with other companies' products were not found in this investigation.
Even so, it's worth verifying what any tool you use is exposing to its model, regardless of the product. The person who filed Issue #107757 also mentioned that they were in the process of migrating to a different tool at their workplace.
The use of Claude Code in professional settings is growing in Japan as well. Consider this scenario.
An engineer at a contract development firm asks Claude Code to look up overseas API documentation for a client project. If the company's email address ends up in a log on the API provider's end, the provider could potentially infer which company was researching which project.
As another example, consider an independent developer who has a personal email address in their Git configuration. Business and personal addresses could become mixed together and end up being sent externally in unexpected ways.
The relationship to Japan's Act on the Protection of Personal Information and internal security policies will need to be assessed by each organization. Some comments in the issue thread raised the question of GDPR (the EU's personal data protection regulation) violations, but these were the opinions of general users, not legal judgments.
No complicated work is required. Work through the following in order:
/plugins to confirm that "cc-plugin-privacy" is enableduser.email) to a dedicated address you're comfortable making publicThe third step in particular is likely to be effective. The idea is to ensure that the address the model can pick up is one you wouldn't mind being exposed.
It has not been confirmed to have happened to everyone. Reports indicate it occurred when the AI was tasked with web searches or research. If you're concerned, check the User-Agent header in curl commands within your session logs.
The person who filed Issue #107757 reported receiving dozens of spam emails per day. However, a causal link to the transmissions has not been confirmed.
Not entirely. It has been noted that cc-plugin-privacy cannot prevent email addresses from appearing inside scripts that the model writes and executes. Until a change that removes account email from the model's context is introduced, it's worth combining the update with a review of your Git configuration.
We generally recommend leaving it enabled. You can disable it via /plugins only if it is unnecessarily interrupting your local work. While it's disabled, make sure to pay close attention to the content of any transmissions yourself.
Start by updating Claude Code to the latest version and reviewing the email address in your Git configuration.
This article is a cross-post from AI Friends.