A ticket filed on the official GitHub repository for Claude Code, Anthropic's command-line coding assistant, claims the tool sends a user's email address to third-party websites during certain operations. The report quickly circulated on Hacker News, though it does not publicly detail the exact mechanism behind the alleged leak. Still, the headline alone was enough to unsettle part of the developer community that relies on the agent to automate programming tasks, including web browsing and documentation retrieval.
Claude Code uses several internal tools, including a web-fetching capability, to let the agent interact with external resources during coding sessions. If identifying information such as an email address ends up embedded in request headers, URL parameters, or logs sent to third-party servers, that would amount to an unconsented personal data leak, potentially exploitable for tracking or profiling by the visited sites.
At this stage, the report remains a community-filed issue rather than a detailed official confirmation from Anthropic. The company has not yet published a precise technical explanation of the behavior or confirmed a fix. Still, having the ticket open on a public repository allows for transparent discussion, where other users can attempt to reproduce the issue, suggest diagnostic steps, or confirm how widespread the exposure might be.
Even unverified in full, the incident reflects a broader concern around AI agents capable of taking autonomous actions on the web. As such tools gain more autonomy, the line between useful automation and unintended exposure of sensitive data becomes a central issue for vendors and for the companies deploying these assistants inside professional development environments.