Claude Code reportedly exposed users’ email addresses to arbitrary third-party websites through the User-Agent header during web searches without permission, leading to an influx of scam emails. The bug report argues this data leak should not be an opt-in setting.