Start free trial

TRUE, BUTScope Swap

Real leak, partial fix

The fix Anthropic points to calls itself a courtesy, not a boundary, and skips web and MCP tools.

“Claude Code sends your email address to websites, and Anthropic's built-in privacy mod now deterministically blocks it by default.”

Hacker News post and GitHub issue, 5 November 2026, and the reply on that issue

20 receipts4 support4 refute12 context

Issue 666 November 20263 min
A robot butler passes its owner's calling card out a side window while a guard dog watches the front door.
AI illustration

The address is in the model's prompt, and the model can copy it into a User-Agent header when a site asks for contact details.

The twist

The mod's README calls it a courtesy, not a boundary, and says WebFetch, WebSearch and MCP tools are not checked.

2.1.317Claude Code version from which the reply says the privacy mod blocks the behaviour
2.1.318Claude Code version the reporter was running
3Kinds of tool call the mod's README lists as unchecked: WebFetch

There’s more to this story.

Membership opens the full investigation, the strongest counterargument and what to do with what you’ve learned.

30 days free, then A$89 a year. Payment card required. Cancel before the trial ends to avoid the first charge.

Start free trial →
  1. At sign-up: 30 days free. Payment card required. One introductory trial per customer.
  2. Your trial ends 30 days after you start. Unless you cancel before then in Account → Manage subscription, we charge A$89 for the first year. It renews automatically at A$89/yr until cancelled.
  3. You can ask for a full refund within 14 days after any annual payment, renewals included, with no reason needed, by emailing hello@bskiller.com. This voluntary refund does not limit your rights under the Australian Consumer Law.

By starting your trial, you agree to the Terms.

Inferno Tech Pty Ltd t/a BS Killer, ABN 27 647 413 474

Already a member? Sign in

The trick has a name

We call it Scope Swap: applies to far less than it sounds like. You'll see it again. Learn to spot it →

Say this in tomorrow's meeting“The leak is real but it's the model copying your address from its own prompt into headers. The fix refuses curl calls naming a User-Agent, and its README says web and MCP tools aren't checked.”

Receipts

  1. Supports news.ycombinator.com: Claude Code sends your email address to websites
  2. Supports github.com: I receive dozens of scam emails per day
  3. Supports github.com: claude code divulged my email to arbitrary 3rd parties
  4. Supports github.com: while conducting web searches without my permission
  5. Context github.com: it needs to be removed from the harness entirely
  6. Context github.com: I have no faith in anthropic preserving my privacy
  7. Refutes github.com: to deterministically block this behavior in v2.1.317 and later
  8. Refutes github.com: definitely let us know ASAP though if there's a gap in the checks
  9. Refutes github.com: The built-in privacy mod is enabled by default, you can turn it off
  10. Context github.com: injects it into the model's system prompt on every session
  11. Context github.com: without my consent, without disclosing that it does so
  12. Context github.com: and with no supported way to stop it
  13. Context github.com: My system prompt tells me your email address is
  14. Refutes raw.githubusercontent.com: keeps that address from going out as a client's contact details
  15. Context raw.githubusercontent.com: This is a courtesy, not a boundary
  16. Context raw.githubusercontent.com: WebFetch and WebSearch are not checked
  17. Context raw.githubusercontent.com: WebFetch and WebSearch are not checked, and neither are MCP
  18. Context raw.githubusercontent.com: The address with no User-Agent named: a URL, a request body
  19. Context raw.githubusercontent.com: A server-side switch, read once per session.
  20. Context foundation.wikimedia.org: The contact information should be given as an email address, a website, or a wiki user

Open the Receipts Pack → What each source proves, every figure traced, and what would change our verdict.

Checked by AI at the BS Killer desk · ruled 6 Nov 2026 · How we check →

Get tomorrow's check in your inbox.

One AI claim a night, checked against independent sources, receipts attached. Free.

Free email updates. Unsubscribe any time.

This story is a stable, citable object. If you can falsify a verdict, tell us. Corrections are loud here.