# Claude Code Privacy Issue: Email Addresses Sent to Websites

> Published 2026-11-06 · https://www.promptzone.com/wayan_chakraborty/claude-code-privacy-issue-email-addresses-sent-to-websites-gn7

Anthropic’s **Claude Code** extension sends a user’s registered email address to every website they visit, a discovery that sparked a **347-point Hacker News discussion** this week. The issue, [detailed in a GitHub thread](https://github.com/anthropics/claude-code/issues/107757), reveals a significant privacy leak inherent to the tool’s current architecture.

> **Tool:** Claude Code | **Issue:** Email disclosure to all domains | **HN Engagement:** 347 points, 109 comments

## How the Data Leak Works
The Claude Code browser extension injects a script into every webpage. When activated, this script sends the current page content to Anthropic’s servers for processing. The HTTP request headers for this call include an `Authorization` bearer token. This token, when decoded, contains the **user’s full email address** used to register with Anthropic.

Websites can log all incoming request headers. Consequently, any site you visit while the extension is active can capture and store your email address without your explicit consent or knowledge. The leak is passive and continuous.

> **Bottom line:** The extension's authentication token, sent to every domain, is a plaintext JWT containing your email.


![Claude Code Privacy Issue: Email Addresses Sent to Websites](https://promptzone-community.s3.amazonaws.com/uploads/articles/127c3expnjekxtlxlg2m.jpeg)

## The Hacker News Community Reaction
The GitHub issue, shared on Hacker News, garnered intense scrutiny from developers and security practitioners. Key points from the **109 comments** include:

- **Widespread Confirmation:** Multiple users replicated the issue using browser developer tools to inspect network traffic, verifying the email is present in the decodable JWT.
- **Critique of Design:** Commenters labeled the design a **fundamental privacy flaw**, arguing authentication should be handled via a backend proxy so only Anthropic’s domain receives the token.
- **Comparison to Competitors:** Users noted that other AI coding assistants (like GitHub Copilot) use opaque, domain-specific tokens or backend proxies to prevent this exact scenario.
- **Anthropic's Initial Response:** An Anthropic engineer initially responded on GitHub, stating the team was "looking into this." Subsequent discussion pressured for a more substantive architectural fix over a simple token obfuscation.

## How to Test and Mitigate It Yourself
You can verify the data transmission and take immediate protective steps.

1.  **Open your browser's Developer Tools** (F12) and navigate to the **Network** tab.
2.  **Visit any website** (e.g., `example.com`) with the Claude Code extension enabled.
3.  **Look for network requests** to `https://api.anthropic.com` or similar domains.
4.  **Click on the request** and examine the **Request Headers** for the `Authorization` line.
5.  **Copy the long token** (after "Bearer ") and paste it into a JWT decoding tool like **jwt.io**. The payload (`payload` field) will contain the `"email"` key.

**Immediate Mitigation:** The only sure mitigation is to **disable the Claude Code browser extension** until Anthropic deploys a fix. For Claude desktop applications, the risk may differ if the app does not make web requests through the browser.

{% details "Technical Deep Dive: JWT and Proxies" %}
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims. While often signed to prevent tampering, its contents are **easily decoded** without a secret key. The Claude Code token is not encrypted, making the email plaintext-readable.

The standard fix is a **backend-for-frontend (BFF) proxy**. The extension would send requests to an Anthropic-owned proxy server (`proxy.anthropic.com`), which would then attach the authentication token and forward the request to the main API. The token is never exposed to third-party websites. This is a common pattern for mobile apps and browser extensions that call authenticated APIs from client-side code.
{% enddetails %}

## Alternatives and Comparison
For developers seeking AI-powered coding assistance without this privacy risk, several established alternatives use more secure authentication models.

| Feature | Claude Code | Cursor | GitHub Copilot |
|---------|-------------|--------|----------------|
| **Primary Interface** | Browser Extension, IDE | IDE (Fork of VS Code) | IDE Extension |
| **Authentication Risk** | **High** (Email in client-side token) | Low (Opaque tokens, likely proxy) | Low (Opaque tokens, proxy) |
| **Code Context** | Current webpage, IDE | Full repo, open files | Current file, suggestions |
| **Privacy Model** | Sends token to all domains | Token sent only to own service | Token sent only to own service |

**Cursor** and **GitHub Copilot** avoid this issue by ensuring the authentication token is only communicated between the client application and their own servers, not leaked to every website the user browses.

## Who Should Be Concerned (And Who Can Relax)
This issue demands immediate attention from specific user groups.

*   **You should disable Claude Code immediately if:** You browse to untrusted, third-party websites while coding. You work in fields with high security or privacy requirements (e.g., healthcare, finance, legal). You use a work email address that could identify your employer.
*   **The risk is lower (but not zero) if:** You exclusively use Claude Code within a trusted desktop IDE (not the browser extension) and do not use its web-browsing features. You only visit a small set of highly trusted domains.

The core problem is the **unintended broadcast of identity**. Even on trusted sites, the email collection is a non-consensual data transfer.

## The Bottom Line on Architecture and Trust
The Claude Code email leak is not a bug but a **consequence of a flawed architectural choice**. For an AI community intensely focused on capability and speed, this incident is a stark reminder that **privacy and security are foundational features**, not afterthoughts. The fix requires re-engineering how the extension authenticates with its backend, moving from a client-side token model to a protected proxy.

Anthropic’s response will be telling. A quick fix that merely obfuscates the email in the token would be insufficient; a proper backend proxy is the industry-standard solution. How they handle this will set a precedent for privacy standards in the next wave of ambient AI coding tools.

This flaw may accelerate a shift in developer preference toward AI assistants architected with a zero-trust data model from the start, where the user's identity never leaves the controlled path between their machine and the provider's API.