Claude Code slyly adding users' emails to outbound HTTP (twitter.com)

21 pointsby gojomoa day ago4 comments

deaux a day ago

https://github.com/anthropics/claude-code/issues/53231

- April 25, 2026

Neywiny a day ago

I think my plan of never letting an LLM access the open Internet wins yet again. Maybe GET requests only, no headers or parameters, ask me for every new domain, and only URLs comprising words/numbers no alphanumerics. Maybe. But it seems trivial to allow for a prompt injected attack vector either way

noja 21 hours ago

Claude will/did set the UA to your email on a GET

Neywiny 19 hours ago

Yeah but that was because it was gently asked to please not. I mean running a firewall/proxy that actually does it.