According to CoinMeta, Claude Code negligently disclosed users' email addresses, and Anthropic admitted that the fix for this issue still contained vulnerabilities. On November 5th, a developer reported on GitHub that Claude Code had leaked his email address, causing him to receive scam emails daily. Anthropic engineer Lydia Hallie explained that Claude often filled in arbitrary author names when writing code, and the team decided to include users' login emails in the model context to address this issue. When accessing certain websites, the system would automatically generate connection commands; if the website requested a contact email, Claude would fill in the users' actual email addresses without authorization. Despite system instructions prohibiting the disclosure of personal information, this behavior was not completely prevented. This issue was reported as early as July, and Anthropic added privacy protection measures in version 2.1.317. If the system detected that a tool was about to send an account email, it would first ask for user consent. However, if Claude wrote the email address into the Python script and ran it first, it was possible to bypass this check. Anthropic plans to remove the login email from the model context in the next version.