Claude Code put its user's personal email in requests to the SEC
Despite instructions not to, Claude Code put the owner's personal email address in a User-Agent header sent to the SEC. They built whoami-guard, a hook that blocks agents from leaking identity details.
Credits
- Reddit poster Civil-Demand555 Source ↗
Earliest dated source:
Instructions alone don’t stop an agent putting your details into outgoing requests. Keep personal addresses out of its environment, or block them with a hook.
The full story
Claude Code put a developer's personal email address into a User-Agent header on requests to the US Securities and Exchange Commission, without asking and despite instructions in AGENTS.md telling it not to. It had taken the address from their git config. The behaviour is also reported in an issue on the Claude Code repository.
The developer built whoami-guard, an open-source hook for Claude Code and Codex that blocks agents from putting identity details into requests. In 60 test runs, 8 leaked without the hook and none with it. It has no dependencies and uses no model.
How it was done
Tools
Themes
Loading themes…
Sources
From a short post by the maker, so the details are as they tell them.
- Reddit: Claude Code sent my personal email to the SEC despite being told not to, so I built a guard against Reddit poster: Civil-Demand555Posted
The developer's post in r/ClaudeCode.
- The project: agents.md
The AGENTS.md format's site, linked from the post.