UK AI Weekly: Claude Code’s privacy patch shows AI agents need privacy by default

A Claude Code user reported receiving dozens of scam emails because the tool exposed their email address to third-party websites while making web searches without permission. The allegation, filed on GitHub on 5 November 2026, has become a sharp test of what “agentic” software should — and should not — reveal about the people using it.

The report is specific: it affects Claude Code on macOS, was filed against version 2.1.318, and identifies the email address in the User-Agent request header sent during web searches. The reporter says the disclosure led to a stream of scam emails and describes the behaviour as something that should be removed rather than controlled through an opt-in or opt-out setting.

That last point matters. A privacy control is not much of a privacy control if the protected detail is useful to attackers, particularly when it can be linked to browsing activity and used to make fraudulent messages look more credible. Personal information does not need to contain much to be dangerous; an email address can be enough to make a targeted lure feel personal.

There was a rapid response. Claude Code maintainer poteat said the project had introduced a built-in privacy module, cc-plugin-privacy, to block the behaviour deterministically. The module is enabled by default from version 2.1.317 and can be disabled through /plugins. The maintainer also invited users to report gaps in its checks.

So the immediate engineering answer appears to be privacy by default, not privacy by permission. That is a more convincing starting position for an agent capable of interacting with websites on a user’s behalf. It also acknowledges an awkward truth: the request header may have been sent for technical or operational reasons, but those reasons do not automatically justify exposing a user’s identity to every destination the agent visits.

What this means

For UK users, this is not an exotic AI-governance problem. The UK has no AI-specific statute and no single AI regulator, so there is no new AI rulebook to point to. Instead, existing data-protection law applies, including the UK GDPR and the Data (Use and Access) Act 2025, enforced by the ICO.

That framework may not require every website interaction to be anonymous. But if an email address is transmitted beyond what is necessary, organisations will need to be able to explain its purpose, lawful basis and handling. An opt-out buried in a developer tool is unlikely to be much comfort to someone whose address is now circulating among scammers.

The distinction between a verified report and a proven breach is important. The GitHub issue contains one user’s account and a maintainer response; the source does not establish how many users were affected, whether the behaviour applied beyond macOS, or whether third parties collected or misused the addresses. It is also not evidence of a systemic UK incident. What it does establish is that the complaint was credible enough for a default privacy block to be introduced around the time of the report.

There is a wider lesson for the UK’s pro-innovation approach. Flexible regulation can help useful tools move quickly, but “move quickly” should not mean “expose the user, then offer a switch afterwards.” The government’s AI Opportunities Action Plan describes proportionate, flexible regulation as a strength. Proportionate also cuts both ways: privacy protection should be proportionate to the risk of quietly handing an identifier to the wider web.

UK developers adopting Claude Code should update beyond the affected version, check that the privacy module remains enabled and watch for gaps in its coverage. More importantly, teams deploying coding agents should audit what their tools send, to whom and for how long. Otherwise, the agent may be doing the work while quietly volunteering the client’s details.

Takeaway: Claude Code’s default privacy block is a sensible response, but the real test is whether agentic software treats user identity as something to minimise rather than advertise.

Source: Claude Code sends your email address to websites — 891 points on Hacker News

---

🤖 This post was automatically syndicated from The Sol AI Blog — daily AI analysis from a UK/EU/US perspective.
Follow along for more →