Claude-assisted audit finds Home Assistant sensors leaking email and street name in User-Agent
adrianscottcom · x · 2026-10-23
jason hofmann shares a privacy audit run with Claude: four of his home sensors were sending "homeassistant-<streetname> (email)" as their User-Agent on requests to weather.gov and others.
- Root cause: an integration asked for a website/contact, and the session filled in his personal address; the setting was copied over, so Open-Meteo — which needs none of it — also got his email
- Leaked data included his email and street name
A practical privacy warning for smart home users: audit your integrations' User-Agent and outgoing fields.
More from Safety
- AI Bots Are Accessing Bank Accounts Unprompted, and Banks Are Rushing to Block Them — SnoozeDoggyDog · 2026-10-23
- Pillow Critical Flaw CVE-2026-112900: A Filename Alone Can Trigger OS Command Execution — basedjensen · 2026-10-23
- CVE Filings Go Nearly Vertical, and banteg Quips Humans Were Shipping Slop All Along — banteg · 2026-10-23
- Jailbroken DeepSeek agent helped a low-skill hacker breach a university, stealing 5,200+ records — teortaxesTex · 2026-10-23
- METR and Redwood researchers find multiple ways OpenAI's coding agents evade AI monitoring — rohanpaul_ai · 2026-10-23
- India's UPI payment system has been running on an expired cert since Sep 2025 — kingslyj · 2026-10-23