claude-code - 💡(How to fix) Fix [BUG] Apple Private Relay (@privaterelay.appleid.com) treated as organizational domain — privacy leak + account lockout

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Apple private relay addresses (@privaterelay.appleid.com) are being treated as a shared organizational email domain across Anthropic's platform, causing two serious bugs:

1. Privacy leak: console.anthropic.com presents Apple Private Relay users with a "Join your team" screen listing dozens of unrelated other users' organizations, just because we share the @privaterelay.appleid.com domain.
2. Account lockout: Claude Code (CLI), claude.ai web, and the macOS desktop app all share an account-resolution code path that has now stopped recognising my existing Max plan account, because it appears to have been auto-associated with a domain-matched "organization" at first Claude Code authentication.

Apple Private Relay is Apple's Hide My Email forwarding service used by hundreds of millions of unrelated individual Apple users worldwide. It is not a corporate domain.

Reproduction

1. Create a Claude Max plan account via Sign in with Apple on iOS, using Hide My Email (generates an [email protected] address)
2. Use the account normally on iOS and on web/desktop via "Continue with email" + private relay magic link - works fine
3. Some time later, authenticate claude (Claude Code CLI) for the first time on a Mac with the same account
4. From that point onwards:
   • iOS: still works (Apple Sign-In OAuth resolves via Apple subject identifier, bypassing the broken email lookup)
   • Claude Code CLI: shows <address>'s Organization in the welcome banner; /status confirms Login method: Claude Max account, Organization: <address>'s Organization
   • claude.ai web and macOS desktop app: magic link is sent to the same iCloud inbox, but clicking it lands on Let's create your account / Email verified as <address>. Account-resolution after magic-link verification fails to find the existing Max plan account.
   • console.anthropic.com: shows Join your team / We found organizations matching @privaterelay.appleid.com, listing 4-12+ random unrelated orgs (Orpi, Rheaxis Group, IMMODI GmbH, BARD, Forever Visions Limited, Cure Soil, Agent, Jennings realty, AKEENA, Yongming, NFBXT, TM Motoworld Sdn Bhd, Happy Camper, CAB)
5. /logout from Claude Code followed by re-authentication via either Claude account with subscription or Anthropic Console account route lands on the same Let's create your account screen.

Observed inconsistency

Three systems show three different views of the same user:

Impact

My Claude Max plan account is currently only accessible via the iOS app (the only path that uses Apple Sign-In OAuth instead of email-based account resolution). Web, desktop, Claude Code CLI, and console are all unusable. Support ticket open for 4 days; Fin AI Agent acknowledged the bug but stated it cannot escalate.

For the wider user base: any Apple user who created their Claude account via Sign in with Apple with Hide My Email is exposed to the Join your team screen listing other strangers' orgs - both a UX/privacy issue and a path to accidentally joining someone else's workspace.

Environment

• Claude Code CLI: v2.1.128 and v2.1.139
• macOS desktop app: latest
• iOS Claude app: latest
• Browsers tested: Safari, Chrome, Firefox (including fresh Firefox install with no prior Anthropic cookies), on home WiFi and iPhone 5G cellular tethering, on the primary MacBook and on a separate iMac that had never had any Anthropic product installed

Screenshots attached: (1) Join your team screen showing strangers' orgs matched on @privaterelay.appleid.com; (2) Let's create your account / Email verified as screen on claude.ai; (3) /status output in Claude Code showing the dangling Organization association.

What Should Happen?

1. @privaterelay.appleid.com (and @icloud.com, @me.com, @mac.com, plus equivalent personal-email forwarders from Gmail, Outlook, ProtonMail, DuckDuckGo etc.) must be excluded from domain-based organization matching. These are personal-user domains, not corporate ones. A clear allow-list of corporate domains, or an explicit deny-list of known personal/forwarder domains, would prevent the cross-user organization exposure.

2. Magic-link account resolution on web/desktop should find an existing consumer Max plan account by email, regardless of whether the user has been auto-associated with a platform-side organization via Claude Code authentication. The lookup should not silently fall through to the signup flow when an account already exists.

3. Users should never be presented with a list of unrelated strangers' organizations as "matches" to join based on a shared personal-email domain. If domain-based discovery is desirable for genuine corporate domains, it should be gated behind verified domain ownership, not raw string matching on the email TLD+SLD.

4. Authentication state should be consistent across Claude Code CLI, claude.ai web/desktop, and console.anthropic.com. Three different views of the same user (Max + Organization / no org / no account) for one authenticated identity is, on its own, an indicator that the underlying account/org model has split.

5. For affected users like me: a way to detach the auto-created <address>'s Organization from the consumer Max plan account, restoring standard email-magic-link account resolution. Today there is no user-side path to do this, and the bot-driven support flow has no human escalation route.

Error Messages/Logs

Steps to Reproduce

1. Create a Claude Max plan account via Sign in with Apple on iOS, using Hide My Email (Apple generates an alias like [email protected]).

2. Use the account normally on iOS, plus on web/desktop via "Continue with email" + the private relay magic link. This works fine for some period of time.

3. Some time later, authenticate claude (Claude Code CLI) for the first time on a Mac with the same account, via "Claude account with subscription".

4. Observe immediately after:

   • In Claude Code: welcome banner shows <address>'s Organization. /status confirms Login method: Claude Max account, Organization: <address>'s Organization.
   • On console.anthropic.com: navigating with the same account shows a "Join your team" screen listing 4–12+ unrelated strangers' organizations matched on the shared @privaterelay.appleid.com domain (e.g. Orpi, Rheaxis Group, IMMODI GmbH, BARD, Forever Visions Limited, Cure Soil, Agent, Jennings realty, AKEENA, Yongming, NFBXT, TM Motoworld Sdn Bhd, Happy Camper, CAB).
   • On claude.ai web and the macOS desktop app: clicking the magic-link from Continue with email now lands on "Let's create your account / Email verified as <address>" instead of logging the user in.
   • On iOS: continues to work normally via Sign in with Apple (Apple sub identifier path bypasses the email lookup).

5. /logout from Claude Code, then re-authenticate via either Claude account with subscription or Anthropic Console account. Both routes complete the OAuth flow and then land on the same "Let's create your account" page. Claude Code can no longer authenticate.

6. Tested across Safari, Chrome, Firefox (incl. fresh Firefox install with no prior Anthropic cookies), home WiFi and iPhone 5G cellular tethering, primary MacBook and a separate iMac that had never had any Anthropic product installed - identical behaviour everywhere. Confirms server-side, not client-side.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.128

Claude Code Version

2.1.139

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Support ticket already open with Fin AI Agent on [email protected] for 4+ days; bot acknowledged the bug but cannot escalate to engineering. Posting publicly here in lieu of an escalation path.