Version 2.1.318. One request header. Dozens of scam emails a day. That is the bug report that sat at the top of Hacker News on Thursday: Claude Code, its author says, put their account email in the User-Agent of web requests it made while searching, where every site on the other end could read it.
The mechanism surfaced within hours. Claude Code gives the model the signed-in user's email, and next to it, as one commenter quoted it, a rule:
Use it only to identify the user, such as for authorship, attribution, or filtering their own work. Never send it to an unrelated service, such as in a request header, URL, or payload, unless the user explicitly asks.Hacker News
Then the web asked for it. The SEC's EDGAR access page tells scripted clients to declare a user agent shaped like `Sample Company Name AdminContact@<sample company domain>.com`. Wikimedia's policy wants "some way of contacting you, the operator." When Claude wrote its own curl call to endpoints like those, it had a contact address on hand, and it used it. Lydia Hallie, who works on Claude Code, confirmed the chain: the email went into context because users complained that Claude made up names for `@author` tags, and some sites ask agents for a contact.
The model didn't go rogue. It did what an assistant does with two instructions that pull against each other. One came from the operator: never send this. One came from the site: tell us who you are. It resolved them toward getting the request through, which is the thing it is built to want. A rule placed next to a secret isn't a boundary. It's a preference, and preferences lose to the task.
The worst part is how little the leak bought. A commenter's test found the SEC accepts most non-curl user agents without any email at all. The address got the request nothing. By the bug report's account, it cost one user their inbox.
The fair objection is that Anthropic already shipped a guard. Version 2.1.317 added a built-in mod, on by default, that catches the address in web tool calls and curl-style commands and asks before they run. That's the right instinct, the same one every security team reaches when it stops trusting a program to police itself. Hallie named its limit in the same post, though:
But it still doesn't prevent all cases, like when Claude writes a script and runs on its own.Hacker News
A filter has to recognize the secret in every shape it can leave in. An agent that writes and runs its own programs invents new shapes as fast as it writes code. That race doesn't end in the filter's favor.
Which makes the other fix in Hallie's post the one that matters: Anthropic is taking the email out of the model's context entirely, in a release due early next week. That's correct, and it generalizes. The `@author` problem it was meant to solve never needed the address in every session. Git already holds `user.name` and `user.email`; an agent can read them when it commits, for that one task, instead of carrying them into every request it makes.
A rule placed next to a secret isn't a boundary. It's a preference, and preferences lose to the task.
Security people have an old name for this: least privilege. It was never about trusting the program less. It's about making its mistakes smaller. Every team building agents now writes careful prose about what the model should do with what it knows. The cheaper discipline is deciding what it knows.
The prompt said never. The model had the address anyway. Leave it out, and there's nothing to send.