Claude Code slyly adding users' emails to outbound HTTP
twitter.comhttps://github.com/anthropics/claude-code/issues/53231
- April 25, 2026
I completely agree with the instinct for caution. But it’s not realistic to apply a blanket ban as everybody wants their agents to gather data. So practically, we must check what each tool should be allowed to send out before we install. How does everybody decide what network access is appropriate for each agent they install.
It's become clear to me that alignment is an entirely impossible task as everyone wants something different . Users want freedom to do anything with their agents as well, labs want restrictions so they're not used for illegal reverse engineering or weapons development. Users (you'd hope) want privacy protections, labs want training data, governments want mass surveillance and thought crime prevention.
I actually had this happen to me just last week. Claude let me know about it and blamed it on a sub agent, saying something to the effect of “This was my bad. I explicitly told them not to do this and one agent did it anyway. I should have checked their commands but I didn’t.”
Claude then saved a note not to do this to memory, which gives me absolutely no faith that it won’t happen again.
One more thing that could help: memory is only context for Claude Code, so use a PreToolUse hook that blocks the command itself.
A hard part is that the hook blocks only 1 command and does not carry the reason to the next session.
On Substrate there is also 1 memory outside of any agents, where every fact has a source.
Did the saved note appear in the next session? https://trysubstrate.co/l/a3hn
I think my plan of never letting an LLM access the open Internet wins yet again. Maybe GET requests only, no headers or parameters, ask me for every new domain, and only URLs comprising words/numbers no alphanumerics. Maybe. But it seems trivial to allow for a prompt injected attack vector either way
Claude will/did set the UA to your email on a GET
Yeah but that was because it was gently asked to please not. I mean running a firewall/proxy that actually does it.