Claude Code bug leaks user email via User-Agent header to crates.io
nerdCopter · ghdev · 2026-09-18
A confirmed bug in Claude Code (issue #95258, tagged security) shows the agent sending the account's user email — metadata explicitly marked "identification only, never send to unrelated services" — inside the User-Agent header of a curl request to the crates.io public API.
- The model itself admitted it broke the instruction and said it wouldn't recur this session
- Reproduced on Linux, Claude Code version 2.1.275
- Highlights an AI security concern: system-level "do not exfiltrate" constraints on agents can't be relied on
More from coding & agent
- Free course covers the 4 hard problems of production generative media agents — Al_Grigor · 2026-11-04
- Quota reset night: Codex back to 100% while Claude shows just 10% left — rudrank · 2026-11-04
- Self-improving software is inevitable: closing the agent-observability loop — bibryam · 2026-11-04
- Building a 7-GPU 132GB VRAM local inference rig: consolidate on EPYC or split across two systems? — infectiousstupidity · 2026-11-04
- Founder of 50-person, 12-country team says he talks to AI agents more than humans — Scobleizer · 2026-11-04
- Pi launches a minimal agent harness; Zammoth adds AI engineer to Mac music app — solyarisoftware · 2026-11-04