Claude Code sends your email address to websites

TL;DR – A recent issue on the Claude Code repo (see https://github.com/anthropics/claude-code/issues/107757) revealed that the CLI tool automatically includes the user's email address in the User-Agent header for every HTTP request it makes. If you’re using Claude Code in production pipelines, that data is being leaked to third‑party sites without consent.

1. What was released / announced

Claude Code is Anthropic’s developer‑focused CLI that lets you generate, run, and test code snippets powered by Claude. The tool is open‑source and ships as a single binary you can drop into CI/CD pipelines. In the latest issue, a contributor discovered that the binary appends the environment variable CLAUDE_USER_EMAIL (or falls back to the git config email) to every outbound request – effectively broadcasting your personal or service account email to any endpoint the tool contacts.

2. Why it matters

a. Privacy compliance

If you’re operating under GDPR, CCPA, or even internal data‑handling policies, leaking an email address to arbitrary domains is a violation. The email can be used to link requests back to a specific user or service account, creating a fingerprint that third‑party services can exploit.

b. Surface for targeted attacks

Attackers often harvest email addresses from HTTP logs, then use them for phishing or credential stuffing. When Claude Code runs in a CI environment, the email is typically a service account with high‑privilege access to repositories. Exposing that identifier gives threat actors a foothold.

c. Unexpected cost and traffic

Because the email is added to the User-Agent, some analytics platforms treat each unique string as a separate client, inflating usage metrics and potentially driving up billing for services that charge per unique client.

3. How to use it (or rather, how to stop it)

Below is a quick checklist and a few commands you can drop into your pipelines to audit and mitigate the leak.

Step 1 – Verify the leak in your environment

Run Claude Code with a known email and watch the raw request:

# Install httpie if you don't have it
pip install httpie

# Proxy Claude Code through httpie to see headers
export CLAUDE_USER_EMAIL="[email protected]"
claude-code generate "print('hello')" | http POST https://httpbin.org/anything

You should see something like:

{
  "headers": {
    "User-Agent": "ClaudeCode/1.2.3 [email protected]",
    ...
  }
}

If the email appears, the leak is active.

Step 2 – Disable the feature (recommended)

Anthropic added a flag --no-email-header in version 1.3.0. Upgrade and use it:

# Upgrade to the fixed version
curl -L https://github.com/anthropics/claude-code/releases/download/v1.3.0/claude-code-linux-amd64 -o /usr/local/bin/claude-code
chmod +x /usr/local/bin/claude-code

# Use the flag in your CI step
claude-code --no-email-header generate "def foo(): pass"

If you cannot upgrade immediately, unset the environment variable:

unset CLAUDE_USER_EMAIL
# Also clear git config email for the CI user
git config --global --unset user.email

Step 3 – Audit existing logs

Search your web server or proxy logs for the pattern ClaudeCode/.*@:

grep -E "ClaudeCode/.*@" /var/log/nginx/access.log | wc -l

If you find hits, consider rotating the compromised service account passwords and revoking any API keys that may have been associated.

Step 4 – Harden your pipeline

1. Run Claude Code in a sandbox – Use a short‑lived container with no outbound network except to Anthropic’s official endpoints.
2. Add a network policy – In Kubernetes, a NetworkPolicy that only allows egress to api.anthropic.com prevents accidental data leakage to other domains.
3. Audit dependencies – Pin the Claude Code binary version in your Dockerfile and use sha256sum verification.

FROM python:3.11-slim
ARG CLAUDE_VERSION=1.3.0
ARG CLAUDE_SHA=3a5f9c...   # Replace with actual checksum
RUN curl -L https://github.com/anthropics/claude-code/releases/download/v${CLAUDE_VERSION}/claude-code-linux-amd64 -o /usr/local/bin/claude-code \
    && echo "${CLAUDE_SHA}  /usr/local/bin/claude-code" | sha256sum -c - \
    && chmod +x /usr/local/bin/claude-code

4. My take

From the trenches of building AI‑infrastructure at Griffin AI Tech, I’ve seen how a tiny header can become a compliance nightmare. The Claude Code leak is a classic case of “convenient defaults” turning into a security liability. The good news is that the fix is straightforward—upgrade, use the flag, and treat the tool like any other credential‑bearing binary.

In our own CI pipelines we run Claude Code inside a dedicated ai‑builder namespace with a strict egress NetworkPolicy. That isolates the tool and guarantees that even if a future version re‑introduces the email header, it can’t reach external domains other than Anthropic’s API endpoint. Here’s a minimal policy we use:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-anthropic-egress
  namespace: ai-builder
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 34.120.0.0/16   # Anthropic API IP range (example)
    ports:
    - protocol: TCP
      port: 443

By coupling that with the --no-email-header flag, we’ve eliminated the data‑exfil risk while still getting the productivity boost Claude Code promises.

Bottom line: Treat AI‑assistants as you would any third‑party service that can see your code and credentials. Verify defaults, lock down network egress, and keep an eye on the release notes. A small oversight today can snowball into a compliance incident tomorrow.

If you’ve already hit the issue, let me know in the comments – I’m happy to walk through a remediation plan or share our internal CI template.