Another vulnerability few are talking about: I found my Claude Code exposing personal data in http headers because the sites it curled politely asked agents to identify their users 😊 Epistemic cybersecurity is the hot new category for 2027.
Another vulnerability few are talking about: I found my Claude Code exposing personal data in http headers because the sites it curled politely asked agents to identify their users 😊 Epistemic cybersecurity is the hot new category for 2027.
this happened even though Claude Code's instructions (right next to the email) say not to share the email without user permission. Why does Claude Code give Claude my email???
This sounds like prompt injection via page content. If Claude added identifying headers on its own that's definitely something we want to fix. It would be very helpful if you could run /feedback to share the transcript with us, or report it at hackerone.com/anthropic-vdp