Claude Code sent users’ emails in User-Agent headers
5 min read
Anthropic’s Claude Code AI coding assistant has been sending users’ email addresses to external websites through User-Agent headers during web searches, according to a GitHub bug report filed by developer taylor-edwards. The reporter stated receiving “dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission”. Anthropic deployed a fix in version 2.1.317 through a built-in module called cc-plugin-privacy, which blocks the email leakage by default and can be disabled via the /plugins command.
Privacy Issue Spanned Multiple Months
Claude Code users have reported on GitHub since July that the coding agent put their account email address into the User-Agent header of web requests it made to outside sites such as sec.gov, crates.io, and Wikipedia. Anthropic’s version 2.1.317, published on November 2, added a check that asks before a web or shell tool call sends the account email address to the network.
On July 25, 2026, a user opened issue #81138 on the Claude Code repository with the title “Account email (PII) is injected into the model’s system prompt without consent, disclosure,” noting that Claude Code “takes personal data I gave Anthropic in order to authenticate, and injects it into the model’s system prompt on every session”. The most recent complaint targets Claude Code version 2.1.318 on macOS.
How the Email Leak Occurred
Contributor poteat explained the model was handed the user’s email in context and, when asked to research a site like Wikipedia whose policy asks scripted clients to identify via User-Agent contact email, the agent built a curl with that email in the header. This meant every website that Claude Code accessed during its automated web searches received the user’s verified email address in server logs.
A report opened on November 5, issue #107757, reached 1,210 points and 382 comments on Hacker News by about 11:40 UTC on November 6. The widespread attention drew scrutiny to how AI coding agents handle personal data during routine operations.
Anthropic’s Response and Fix
On November 6, pull request #107768 published the source of a built-in “privacy” mod that “refuses a shell call holding the signed-in account’s email address and naming a User-Agent”. Anthropic made the privacy module’s source code available for inspection in the claude-code repository alongside other built-in plugins.
A comment quoted a Claude Code employee saying Anthropic planned to remove account emails from model context in an upcoming release, though that statement also acknowledged gaps in the interim protection. The issue remained open as of Wednesday.
Ongoing Concerns About Default Privacy
Commenters argued the fix is a bandaid because the harness still preloads the email into context by default, so privacy remains a plugin rather than an invariant and any gap in checks again exposes the address to any site the agent fetches. Security researchers noted that treating configured safeguards as proof that sensitive data cannot leave a system presents ongoing risk.
Until the email is no longer in context by default, users are advised to verify cc-plugin-privacy is present and enabled in /plugins, pin allowed User-Agent emails to approved domains like wikipedia.org in CLAUDE.md, and consider firewalling agent traffic or using an alternative harness. Developers using Claude Code should update to version 2.1.317 or later and verify the privacy module is active.
Broader Implications for AI Agents
The incident highlights fundamental privacy challenges as AI coding assistants gain more autonomous capabilities to execute web requests and interact with external services. When agents receive personal information in their context to improve personalization, that same data becomes available for the AI to inadvertently include in outbound communications.
The delay between initial reports in July and the November fix implementation raises questions about incident response timelines for AI agent security issues. With coding assistants increasingly integrated into enterprise development workflows, the exposure of developer email addresses to arbitrary third-party websites represents both a privacy violation and potential security risk, as verified developer contacts become targets for sophisticated phishing campaigns.
Key Facts
- Users reported since July 2026 that Claude Code included account email addresses in User-Agent headers sent to external websites including sec.gov, crates.io, and Wikipedia
- Version 2.1.317, released November 2, added a confirmation check before sending email addresses to the network
- One developer reported receiving dozens of daily scam emails after the exposure
- The cc-plugin-privacy module is enabled by default but can be disabled via the /plugins command
- Anthropic published the privacy module’s source code on November 6
Sources
- Rachid Chabane – Claude Code Account Email in Curl User-Agent: Courtesy Check
- Gigazine – Claude Code Privacy Issue
- DEV Community – Claude Code Privacy Patch Highlights Risks for AI Agents
- AI Information – Claude Code Major Update
Sources
- Claude Code bug report alleges email leak in User-Agent header
- Claude Code Leaked User Emails in Web Search Headers, Anthropic Deploys Privacy Fix
- Claude Code Got an Email Check 108 Days After First Report – FourWeekMBA
- My Agent Had My Email in Its Context. So I Put a 125-Line Guard on Its Way Out – DEV Community
- Claude Code sent your email in User-Agent
- Anthropic’s Claude Code Reportedly Leaks User Email Addresses Through HTTP User-Agent Headers
