A user alleges that Claude Code exposed their email address to unrelated websites by including it in the User-Agent header of requests made during web searches. They say the disclosure coincided with receiving dozens of scam emails each day and argue that sending a user’s email this way provides no meaningful benefit: it neither helps websites block automated traffic nor protects the user’s anonymity, while making the address available to potential scammers. The report identifies the affected environment as macOS, using Claude Code version 2.1.318 in tmux, and was filed on November 5, 2026.
The user wants the email address removed from the request mechanism entirely, rather than making disclosure an opt-in or opt-out setting. They say the incident has undermined their confidence in Anthropic’s privacy protections and that they are moving their company to Pi with OpenRouter. The report is labeled as a security and tools bug affecting macOS and remains open, with no assignee or proposed fix shown. The only displayed comment is a sarcastic remark about corporations caring about privacy; no substantive response or investigation appears in the supplied discussion.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A URL-encoding flaw in Hugging Face Chat let unauthenticated requests bypass an admin check and trigger bulk exports of users’ private conversations. The exported data was sent to a configured dataset destination rather than returned directly to the requester. (twitter.com)
Claude Code’s “Don’t Ask Again” setting was linked to passwords and other secrets being exposed in 1,122 public GitHub files. The finding highlights how coding-agent features can accidentally put sensitive data into public code repositories. (apiiro.com)
Hackers stole $133 million from a French bank by targeting a service provider. The available details do not explain how the attack was carried out. (bleepingcomputer.com)
U.S. intelligence reportedly believes Nvidia CEO Jensen Huang had a romantic relationship with suspected Chinese spy Alice Huang, who allegedly sought access to restricted AI chips. Alice Huang is linked to Megaspeed, whose subsidiary faces allegations of smuggling $2 billion in AI chips into China. (tomshardware.com)
A report alleges China is linked to at least 18 overseas police stations in Canada, including three in the Greater Toronto Area. The RCMP is investigating reports of criminal activity connected to the stations. (ctvnews.ca)
Colframe is a low-interaction honeypot that imitates supermarket refrigeration controllers from Danfoss and Dixell. It is designed to attract and observe activity targeting these systems, including Modbus-based threats. (github.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.