Claude Code Put Users' Email Addresses in Web Request Headers

A GitHub bug report filed on November 5 describes a Claude Code email leak: Anthropic’s coding agent was writing signed-in users’ account email addresses into the User-Agent header of outbound web requests. The report, GitHub issue #107757, spread quickly among developers, and a Hacker News thread about it climbed overnight. The reporter says they now get “dozens of scam emails per day” and ties the leak to that spam, a connection the available reporting has not proven. Anthropic has since shipped a privacy module, but outlets disagree about how much it covers.

Claude Code email leak: which versions are affected and fixed

The bug report names Claude Code 2.1.318 on macOS as the affected build, and the author says he is moving his company to Pi with OpenRouter, according to AI Weekly. The fix came earlier. Claude Code 2.1.317 was released November 3, and its changelog lists an added check that asks before a web or shell tool call sends the account email address to the network, as DEV Community reported.

That sequence raises an obvious question. The reporter was running a build newer than the fix, yet said the protection was not visible in their setup. The table below lays out the dates in the public record.

How the email reached third-party websites

According to an Anthropic contributor’s explanation relayed by StartupHub, the chain had three links. The model was handed the user’s email in its context. When asked to research a site such as Wikipedia, the agent built a curl request with that address in the header. Wikipedia’s policy asks scripted clients to identify themselves with a contact email in the User-Agent, and Clauding identifies that rule as the trigger.

No single line of code caused the problem. The address already sat in the agent’s context, the agent treated a site’s etiquette rule as a template to fill in, and the tool passed the value out to the network. That makes it a leak from the tools themselves, not only from what the model reads.

A contributor identified as poteat wrote in the GitHub thread that no one had implemented email sharing as a feature. That point matters because it frames the behavior as an accident of design rather than a deliberate product choice.

Anthropic’s fix and the cc-plugin-privacy module

Anthropic’s public response is inconsistent across the sources USA 24 reviewed. LAVX News reports that a contributor said the behavior was not an intentional feature and that the company deployed a fix in version 2.1.317 through a built-in module called cc-plugin-privacy. That module blocks the email leak by default. Daily.dev adds that the module can be turned off, which removes the protection.

An earlier report written at filing time said Anthropic had not publicly replied on the thread. USA 24 found no official Anthropic blog post or security advisory on the issue as of publication.

The module is source-available, so developers can read the code and audit what it does. That transparency helps, but it also cuts the other way. A reporter on version 2.1.318 said they could not find cc-plugin-privacy in the /plugins list, which means some users may believe they are protected when they are not.

Does a plugin-level guard actually fix it?

This is the central dispute. Commenters argued that the harness still preloads the account email into the model’s context by default. In that design, privacy depends on a plugin that filters traffic on the way out, not on the data being absent in the first place. The reporter made a similar point in the issue, writing that “it needs to be removed from the harness entirely.”

Earlier reporting points the same direction. Issue #81138, opened July 25, argued that the account email was placed in the model’s system prompt without consent. According to that report, the value came from a local config file under the account’s email field.

An unverified statement attributed to an Anthropic employee says the company plans to remove the account email from the model’s context in an upcoming release, as CCTest noted. USA 24 could not confirm that statement, and it found no official Anthropic post making that commitment.

The distinction matters. A filter that blocks a header can be disabled, misconfigured or bypassed by a new tool path. Removing the address from the context removes the data at its source. The second approach is the stronger default in most privacy engineering, because a value that is never present cannot leak, while a filter can fail.

Is the scam email wave connected to the leak?

The reporter says they receive dozens of scam emails a day and links the spam to the leak. The available material does not independently establish that the reported wave of scam email was caused by this behavior. Email addresses circulate through many channels, including data breaches, public listings and marketing lists, so one account cannot isolate a single source. Readers should treat the link as a hypothesis to test, not a finding.

The scale of the problem is also unknown. Nobody has published how many Claude Code users were affected or how long the behavior ran before the fix. Hacker News figures vary by outlet as well. UseCarly reported more than 1,300 points for the thread, while Clauding counted 687 points within hours. Those numbers show interest, not verification.

What Claude Code users should do now

The steps below come from outlet reporting and should be checked on your own install.

1. Update Claude Code to version 2.1.317 or later, then confirm the installed version.
2. Open /plugins and confirm that cc-plugin-privacy appears and is enabled. If it is missing, as one reporter found on 2.1.318, treat that install as unprotected and add your findings to the GitHub thread.
3. Leave the module on. Disabling it removes the only default protection reported so far.
4. If your agents browse the web, pin the contact emails they may send in User-Agent headers to approved domains, or route agent traffic through a firewall that filters outbound requests. StartupHub recommends this approach.
5. If you used Claude Code’s web search on a signed-in account and now see spam, watch the pattern, but do not assume the agent caused it without evidence.
6. Consider rotating credentials. One third-party troubleshooting site advises revoking and regenerating your API key and reporting the issue to [email protected]. Anthropic has not confirmed that advice, so treat it as an optional precaution.

Businesses running AI coding agents on shared codebases have more to weigh. A leak on one developer’s machine can expose a company’s account identity, and a shared agent configuration can repeat the same default on every machine that uses it. Teams should audit their agent settings the same way they audit build tools.

The pattern also resembles other default-setting controversies. OpenAI’s Codex training setting was reportedly switched back on without notice, which shows how defaults can shape user data more than users expect.

What comes next for AI agent privacy

Three developments bear watching. First, whether Anthropic publishes a formal advisory and states whether the account email will leave model context by default. Second, whether cc-plugin-privacy ships on by default for every install path and appears where users can verify it. Third, whether other agent tools face the same header problem, since the underlying pattern depends on a generic etiquette rule for scripted clients rather than anything specific to Claude.

The policy backdrop is moving too. Claims Journal, citing Bloomberg, reported that Democrats plan to introduce AI bills once they take control of Congress, including independent testing of advanced models and clarification of when AI companies can be held liable for harm their products cause. A leak like this one, where a tool sends personal data without a clear user decision, is the kind of case those liability rules would test. For a parallel in another company’s filings, see Apple’s warning that AI agents could act without permission.