Claude Code put users' account emails in User-Agent headers sent to websites, bug reports show

What the bug reports describe

A user filed issue #107757 in the public Claude Code repository on 5 November 2026, reporting that version 2.1.318 on macOS had sent their email address to third parties in the User-Agent header during web searches, without asking. The reporter says they now receive dozens of scam emails a day and asked for the behaviour to be removed rather than offered as a setting. The public record does not show that the scam emails came from this leak, or how many users were affected. The issue carries the area:security label and was still open on 6 November.

It was not the first report. Issue #102577, opened on 15 October against version 2.1.300 on Linux, quotes Claude's own explanation that it had put the user's address in the User-Agent string for a Wikipedia search, and that Wikipedia received it in four requests before later requests used a generic header. Coverage by GIGAZINE, Cybersecurity News and several developer sites pulled the reports together, which is how the issue reached a wider audience.

In the new report, the user argues that putting a contact address in the header does not help sites that dislike automated traffic, does nothing for the user's anonymity and mainly benefits spammers. Within a day the thread had dozens of comments, many critical of the response. One commenter pointed out that the address can also escape through git configuration, referencing a separate issue, and said the only complete fix is to stop giving the agent the address at all.

Why the model had the address at all

The root cause is described in issue #81138, opened on 25 July 2026 against version 2.1.220. Its author found that Claude Code reads the email of the signed-in account from its local configuration and adds it to the context of every session, so the model always knows it. The report says this was not documented and had no opt-out. Commenters in that thread describe the model writing the address into git commits, printing it in transcripts and, by late October, putting it into web request headers. According to the Claude Code changelog, version 2.1.234 told the model to use the address only to identify the user and never to send it to an unrelated service unless asked. The address itself stayed in context.

The behaviour has a plausible trigger. Some sites ask automated clients to identify themselves: Wikimedia's User-Agent policy asks for contact details, and the SEC asks scripted EDGAR clients to declare an email address. A commenter in #107757 notes that agents tend to follow such requests, and an agent that knows its user's email will use it. Our reading: this is a privacy failure built from two reasonable pieces, a helpful instruction on a website and a personal detail the agent never needed, and it is the kind of data exposure that is easy to miss in agent design.

What Anthropic changed, and the gaps users report

Replying in #107757 on 5 November, an Anthropic contributor wrote that the company had introduced a built-in mod, cc-plugin-privacy, to deterministically block the behaviour in version 2.1.317 and later. It is enabled by default and can be turned off through /plugins. The changelog entry for 2.1.317 describes it as a check that asks before a web or shell tool call sends the account email address to the network. The reporter was already on 2.1.318.

Users in the thread say the check is narrow. One reports that it only matches the exact account address, so a header that names the user's project instead still goes out, and that the model can write the address into a script file and then run the script, so no checked command contains it. The same user says a test command containing the address was not refused on version 2.1.319. Another commenter asked Anthropic to request a CVE; none had been assigned in the visible thread. Anthropic has not said publicly how many requests carried user addresses or which sites received them.

Commenters also asked why the fix ships as a mod that can be switched off rather than as a change to the core program, and one suggested that requests composed by the model should default to a generic header such as claude-code/<version>, adding a name or contact only when the user asks. Anthropic had not answered those points in the visible thread by 6 November.

What users can do now

Users of Anthropic's agent should update to 2.1.317 or later and leave the built-in privacy check enabled. Commenters in #81138 report that signing in with an API key, Amazon Bedrock or Google Vertex AI instead of a Claude account leaves the address out of the session, and others block it with hooks that deny tool calls containing it. Teams running agents with web access can also check outbound logs for their own addresses. For similar agent tooling problems, see our report on a backdoored Claude Code extension in the Cursor marketplace and the cybersecurity section.

Questions people ask

Did Claude Code leak my email address?

Bug reports show Claude Code sometimes put the signed-in account's email in the User-Agent header of web requests. Anthropic has not said how many users were affected; update to 2.1.317 or later and keep the built-in privacy check on.

How did Anthropic fix the Claude Code email leak?

Version 2.1.317 adds a built-in mod, cc-plugin-privacy, enabled by default, that checks web and shell tool calls for the account email. Users report it can still be bypassed, and the address remains in the model's context.

Is there a CVE for the Claude Code User-Agent leak?

No CVE had been assigned as of 6 November 2026, although a commenter in issue #107757 asked Anthropic to request one.

Sources

1. Bug Report: Privacy violation in User-Agent header (issue #107757) (Anthropic Claude Code issue tracker (GitHub), 5 Nov 2026)
2. Claude Code changelog, version 2.1.317 (Anthropic, 5 Nov 2026)
3. User email exposed in User-Agent header on Wikipedia requests (issue #102577) (Anthropic Claude Code issue tracker (GitHub), 15 Oct 2026)
4. Account email injected into the model's system prompt without consent (issue #81138) (Anthropic Claude Code issue tracker (GitHub), 25 Jul 2026)
5. Anthropic's Claude Code reportedly leaks user email addresses through HTTP User-Agent headers (Cybersecurity News, 6 Nov 2026)
6. Claude Code sends user email addresses to external sites (GIGAZINE, 6 Nov 2026)