# Claude Code Put Users' Email Addresses in Web Request Headers

- URL: https://usa-24.com/claude-code-email-leak-user-agent/
- Publisher: USA 24
- Section: Artificial Intelligence (AI)
- Published: 2026-11-06T16:37:38.025Z
- Updated: 2026-11-06T16:37:38.034Z
- Topics: Claude Code, Anthropic, AI Agents, Data Privacy, Developer Tools

> A GitHub report says Claude Code put signed-in users’ account emails into web request headers. Anthropic reportedly shipped a privacy module in version 2.1.317, but its coverage is disputed.

## Key takeaways

- GitHub issue #107757, filed November 5, 2026, alleges Claude Code wrote signed-in users’ account emails into User-Agent headers on outbound web requests.
- The reported affected build is Claude Code 2.1.318 on macOS, while version 2.1.317, released November 3, added a check before email is sent to the network.
- The cc-plugin-privacy module is reported to block the leak by default, but it can be turned off and one reporter could not find it under /plugins.
- Critics argue the account email should be removed from the model’s context entirely, because a network filter is a weaker default than data that is never present.
- The link between the leak and a wave of scam emails is unproven, and USA 24 found no official Anthropic advisory on the issue.

A GitHub bug report filed on November 5 describes a Claude Code email leak: Anthropic’s coding agent was writing signed-in users’ account email addresses into the User-Agent header of outbound web requests. The report, [GitHub issue #107757](https://github.com/anthropics/claude-code/issues/107757), spread quickly among developers, and a Hacker News thread about it climbed overnight. The reporter says they now get “dozens of scam emails per day” and ties the leak to that spam, a connection the available reporting has not proven. Anthropic has since shipped a privacy module, but outlets disagree about how much it covers.

## Claude Code email leak: which versions are affected and fixed

The bug report names Claude Code 2.1.318 on macOS as the affected build, and the author says he is moving his company to Pi with OpenRouter, according to [AI Weekly](https://aiweekly.co/alerts/claude-code-bug-report-alleges-email-leak-in-user-agent-header). The fix came earlier. Claude Code 2.1.317 was released November 3, and its changelog lists an added check that asks before a web or shell tool call sends the account email address to the network, as [DEV Community](https://dev.to/gabrielanhaia/claude-code-put-account-emails-in-user-agent-headers-stable-21311-lacks-the-guard-5jl) reported.

That sequence raises an obvious question. The reporter was running a build newer than the fix, yet said the protection was not visible in their setup. The table below lays out the dates in the public record.

| Date | Event |
|---|---|
| July 25, 2026 | GitHub issue #81138 says the account email was injected into the model’s system prompt |
| October 15, 2026 | Issue #102577 reports a similar Wikipedia-request problem on Linux, version 2.1.300 (not independently verified) |
| November 3, 2026 | Claude Code 2.1.317 released with a check before email is sent over the network |
| November 5, 2026 | Issue #107757 filed, citing version 2.1.318 on macOS |

## How the email reached third-party websites

According to an Anthropic contributor’s explanation relayed by [StartupHub](https://www.startuphub.ai/ai-news/artificial-intelligence/2026/claude-code-sent-your-email-in-user-agent), the chain had three links. The model was handed the user’s email in its context. When asked to research a site such as Wikipedia, the agent built a curl request with that address in the header. Wikipedia’s policy asks scripted clients to identify themselves with a contact email in the User-Agent, and [Clauding](https://clauding.de/en/posts/claude-code-mail-adresse-user-agent/) identifies that rule as the trigger.

No single line of code caused the problem. The address already sat in the agent’s context, the agent treated a site’s etiquette rule as a template to fill in, and the tool passed the value out to the network. That makes it a leak from the tools themselves, not only from what the model reads.

A contributor identified as poteat wrote in the [GitHub thread](https://github.com/anthropics/claude-code/issues/107757) that no one had implemented email sharing as a feature. That point matters because it frames the behavior as an accident of design rather than a deliberate product choice.

## Anthropic’s fix and the cc-plugin-privacy module

Anthropic’s public response is inconsistent across the sources USA 24 reviewed. [LAVX News](https://news.lavx.hu/article/claude-code-leaked-user-emails-in-web-search-headers-anthropic-deploys-privacy-fix) reports that a contributor said the behavior was not an intentional feature and that the company deployed a fix in version 2.1.317 through a built-in module called cc-plugin-privacy. That module blocks the email leak by default. [Daily.dev](https://daily.dev/posts/claude-code-sends-your-email-address-to-websites-3b2sde9lh) adds that the module can be turned off, which removes the protection.

An earlier report written at filing time said Anthropic had not publicly replied on the thread. USA 24 found no official Anthropic blog post or security advisory on the issue as of publication.

The module is source-available, so developers can read the code and audit what it does. That transparency helps, but it also cuts the other way. A reporter on version 2.1.318 said they could not find cc-plugin-privacy in the /plugins list, which means some users may believe they are protected when they are not.

## Does a plugin-level guard actually fix it?

This is the central dispute. Commenters argued that the harness still preloads the account email into the model’s context by default. In that design, privacy depends on a plugin that filters traffic on the way out, not on the data being absent in the first place. The reporter made a similar point in the issue, writing that “it needs to be removed from the harness entirely.”

Earlier reporting points the same direction. [Issue #81138](https://dev.to/karmabox/my-agent-had-my-email-in-its-context-so-i-put-a-125-line-guard-on-its-way-out-37a5), opened July 25, argued that the account email was placed in the model’s system prompt without consent. According to that report, the value came from a local config file under the account’s email field.

An unverified statement attributed to an Anthropic employee says the company plans to remove the account email from the model’s context in an upcoming release, as [CCTest](https://cctest.ai/en/articles/claude-code-email-leak-raises-questions-about-agent-privacy) noted. USA 24 could not confirm that statement, and it found no official Anthropic post making that commitment.

The distinction matters. A filter that blocks a header can be disabled, misconfigured or bypassed by a new tool path. Removing the address from the context removes the data at its source. The second approach is the stronger default in most privacy engineering, because a value that is never present cannot leak, while a filter can fail.

## Is the scam email wave connected to the leak?

The reporter says they receive dozens of scam emails a day and links the spam to the leak. The available material does not independently establish that the reported wave of scam email was caused by this behavior. Email addresses circulate through many channels, including data breaches, public listings and marketing lists, so one account cannot isolate a single source. Readers should treat the link as a hypothesis to test, not a finding.

The scale of the problem is also unknown. Nobody has published how many Claude Code users were affected or how long the behavior ran before the fix. Hacker News figures vary by outlet as well. [UseCarly](https://www.usecarly.com/blog/ai-news-2026-11-06/) reported more than 1,300 points for the thread, while [Clauding](https://clauding.de/en/posts/claude-code-mail-adresse-user-agent/) counted 687 points within hours. Those numbers show interest, not verification.

## What Claude Code users should do now

The steps below come from outlet reporting and should be checked on your own install.

1. Update Claude Code to version 2.1.317 or later, then confirm the installed version.
2. Open /plugins and confirm that cc-plugin-privacy appears and is enabled. If it is missing, as one reporter found on 2.1.318, treat that install as unprotected and add your findings to the GitHub thread.
3. Leave the module on. Disabling it removes the only default protection reported so far.
4. If your agents browse the web, pin the contact emails they may send in User-Agent headers to approved domains, or route agent traffic through a firewall that filters outbound requests. [StartupHub](https://www.startuphub.ai/ai-news/artificial-intelligence/2026/claude-code-sent-your-email-in-user-agent) recommends this approach.
5. If you used Claude Code’s web search on a signed-in account and now see spam, watch the pattern, but do not assume the agent caused it without evidence.
6. Consider rotating credentials. One third-party troubleshooting site advises revoking and regenerating your API key and reporting the issue to security@anthropic.com. Anthropic has not confirmed that advice, so treat it as an optional precaution.

Businesses running AI coding agents on shared codebases have more to weigh. A leak on one developer’s machine can expose a company’s account identity, and a shared agent configuration can repeat the same default on every machine that uses it. Teams should audit their agent settings the same way they audit build tools.

The pattern also resembles other default-setting controversies. [OpenAI’s Codex training setting](https://usa-24.com/codex-training-setting-opt-out/) was reportedly switched back on without notice, which shows how defaults can shape user data more than users expect.

## What comes next for AI agent privacy

Three developments bear watching. First, whether Anthropic publishes a formal advisory and states whether the account email will leave model context by default. Second, whether cc-plugin-privacy ships on by default for every install path and appears where users can verify it. Third, whether other agent tools face the same header problem, since the underlying pattern depends on a generic etiquette rule for scripted clients rather than anything specific to Claude.

The policy backdrop is moving too. [Claims Journal](https://www.claimsjournal.com/news/national/2026/11/06/341154.htm), citing Bloomberg, reported that Democrats plan to introduce AI bills once they take control of Congress, including independent testing of advanced models and clarification of when AI companies can be held liable for harm their products cause. A leak like this one, where a tool sends personal data without a clear user decision, is the kind of case those liability rules would test. For a parallel in another company’s filings, see [Apple’s warning that AI agents could act without permission](https://usa-24.com/apple-ai-agents-risk-warning/).

## Frequently asked questions

### Did Claude Code send my email address to websites?

It depends on the version and setup. GitHub issue #107757 reports Claude Code 2.1.318 on macOS placing the signed-in account email into User-Agent headers during web requests. Reporting says Anthropic’s fix in version 2.1.317 and the cc-plugin-privacy module block the leak by default, so check your version and the /plugins list.

### Which Claude Code version fixes the email leak?

Version 2.1.317, released November 3, 2026, is reported to add a check that asks before a web or shell tool call sends the account email to the network. Outlets also describe a built-in cc-plugin-privacy module that blocks the leak by default. USA 24 did not find an official Anthropic advisory confirming the fix.

### Are the scam emails caused by the Claude Code leak?

That has not been established. The GitHub reporter says they receive dozens of scam emails per day and links the spam to the leak. The available material does not independently prove that connection, and email addresses circulate through many other sources.

### Can I turn off cc-plugin-privacy?

Reporting says the module can be disabled, which removes its protection. Keeping it enabled is the safer choice until Anthropic publishes a formal statement on how the default works. Critics argue the account email should be removed from the model’s context entirely.

### What should I do if I use Claude Code on macOS?

Update to version 2.1.317 or later and confirm that cc-plugin-privacy is enabled in /plugins. Restrict outbound agent traffic where possible. A third-party site also suggests rotating your API key, but Anthropic has not confirmed that advice.

## Sources

1. [Claude Code bug report alleges email leak in User-Agent header — AI Weekly](https://aiweekly.co/alerts/claude-code-bug-report-alleges-email-leak-in-user-agent-header)
2. [Bug Report: Privacy violation in User-Agent header, issue #107757 — GitHub, anthropics/claude-code](https://github.com/anthropics/claude-code/issues/107757)
3. [Claude Code Leaked User Emails in Web Search Headers, Anthropic Deploys Privacy Fix — LAVX News](https://news.lavx.hu/article/claude-code-leaked-user-emails-in-web-search-headers-anthropic-deploys-privacy-fix)
4. [Claude Code sent your email in User-Agent — StartupHub.ai](https://www.startuphub.ai/ai-news/artificial-intelligence/2026/claude-code-sent-your-email-in-user-agent)
5. [Claude Code Put Account Emails in User-Agent Headers. Stable 2.1.311 Lacks the Guard — DEV Community](https://dev.to/gabrielanhaia/claude-code-put-account-emails-in-user-agent-headers-stable-21311-lacks-the-guard-5jl)
6. [Claude Code Email Risk Exposes Agent Privacy Gaps — CCTest](https://cctest.ai/en/articles/claude-code-email-leak-raises-questions-about-agent-privacy)
7. [Claude Code Sends Your Email Address to Websites in the User-Agent — Clauding.de](https://clauding.de/en/posts/claude-code-mail-adresse-user-agent/)
8. [AI News, Nov 6: The AI Trade Gets Repriced — UseCarly](https://www.usecarly.com/blog/ai-news-2026-11-06/)
9. [Claude Code sends your email address to websites — Daily.dev](https://daily.dev/posts/claude-code-sends-your-email-address-to-websites-3b2sde9lh)
10. [My Agent Had My Email in Its Context. So I Put a 125-Line Guard on Its Way Out — DEV Community](https://dev.to/karmabox/my-agent-had-my-email-in-its-context-so-i-put-a-125-line-guard-on-its-way-out-37a5)
11. [Democrats Planning Flood of AI Bills When They Take Control of Congress — Claims Journal (Bloomberg-sourced)](https://www.claimsjournal.com/news/national/2026/11/06/341154.htm)