On November 5, 2026, a Claude Code user reported that the tool put his email address into the User-Agent header of web requests, and that he now receives dozens of scam emails a day, a consequence he attributes to the leak. The report landed two days after Anthropic shipped a fix for the same behavior, in version 2.1.317, and the new report was filed against version 2.1.318, which already contains the fix. The interesting part is not that a fix exists. It is what the fix covers, and what Anthropic's own documentation says it does not.
What the report says
The report is GitHub issue 107757 in the public anthropics/claude-code repository, opened November 5, 2026, at 22:13 UTC by user taylor-edwards. It targets Claude Code version 2.1.318 on macOS, and it is labeled as a bug affecting security and tools. The core of it reads: "I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission. This should not be a setting with opt-out or opt-in behavior, it needs to be removed from the harness entirely."
Three things in that paragraph need separating, because they are not equally established. First, the mechanism is specific and checkable: the email went out in a User-Agent header during web searches. Second, the demand is absolute: remove the behavior from the harness, do not make it a setting. Third, the scam emails are the reporter's attribution. The report does not include a sample request dump or a reproduction log, and nothing in it establishes that the scam mail came from the leaked address rather than from another exposure. The reporter also says he is migrating his company to Pi with OpenRouter, writing that he has "no faith in anthropic preserving my privacy." Within about three hours the issue had drawn 24 comments, most of them from other users rather than from Anthropic staff.
How an email ends up in a User-Agent header
The mechanism is not a hidden feature. Nobody at Anthropic built a "send the user's email to websites" function, and an Anthropic contributor, poteat, said exactly that in a reply on the thread: "To clarify, nobody implemented this 'share email addresses to websites' as a feature. Models can be highly unpredictable. This is why deterministic checks around model behavior are so important, and why we need to solve alignment."
The chain he described has three links. First, Claude Code hands the model the signed-in account's email in its context, so the model can identify the user. Second, some sites ask scripted clients to identify themselves with a contact email in the User-Agent header. Wikipedia is the example poteat gave: its bot policy asks scripted clients to identify themselves that way. Third, a user asks Claude to research something on Wikipedia, and the model, trying to comply with the site's stated policy, puts the user's email into the User-Agent of its curl call and sends it to a third-party site. The model did what the site asked. The site asked for something the user never agreed to share. That gap, between a site's policy and a user's consent, is the whole bug. Agent tools acting without a clear yes is a pattern this week: Postman installed its own plugins into coding agents the same way, without asking first, and the same question applies there, who authorized the tool to act on the user's behalf?
The timeline: first report in July, fix in November
This is not the first time the behavior was reported. The first report, issue 81138, was filed July 25, 2026, and it is still open. Its title states the complaint plainly: account email is injected into the model's system prompt without consent or disclosure, with no supported way to stop it. On October 24, 2026, security researcher Chris Lakin shared findings on social media showing Claude Code inserting user email addresses into outbound HTTP request headers, which brought the behavior wider attention. The fix shipped November 3, 2026, in version 2.1.317, 101 days after the first report. On November 4, a separate report documented the fix breaking local-only work in headless runs. On November 5, the new report arrived, against a version that already contains the fix.
What the fix blocks, and what it lets through
Version 2.1.317 added what its release notes describe as "a check that asks before a web or shell tool call sends your account email address to the network." The check lives in a built-in mod called cc-plugin-privacy, which is enabled by default and can be turned off through the plugins command. Anthropic has since published the mod's source in the public claude-code repository, so the check itself can be read rather than taken on trust.
The mod's README is unusually candid about its limits. The check is a single tool.check hook. It watches Bash, PowerShell, and Monitor calls, and it refuses a call whose input holds the signed-in account's email and names a User-Agent, with no prompt to the user. The test is two word matches over the whole input, with no parser, on purpose, to keep it simple. And then the README states the limit in its own words: "This is a courtesy, not a boundary, and it covers one shape."
| Shape of the leak | What the fix does |
|---|---|
| Shell call with the address and a User-Agent word | Refused, no prompt |
| Address sent with no User-Agent named (a URL, a request body, curl -u basic auth, a From: header) | Passes, leaves the machine if the line sends it |
| Web tool call (WebFetch or WebSearch) | Not checked at all |
| MCP tool call | Not checked at all |
| Address computed at run time, stored in a variable, or sent from a file | Passes |
| Address encoded a second time, or a non-ASCII address percent-encoded | Passes |
That table is the story. The reported scenario in issue 107757 is web searches, and web tools are the category the README says is not checked. The fix guards one spelling of the leak, a literal email next to a User-Agent word in a shell call, while the address can leave through a header, basic auth, a variable, a second encoding pass, or the built-in web tools the model reaches for first when it researches something. An independent test of the published mod code, run 23 times against the code Anthropic published, found the same shape: it blocks the exact leak from the bug report and lets eight other shapes of the same leak straight through. That test is one independent check of published code, not Anthropic's own claim, and it is labeled as such here.
The fix can also be switched off. The README lists four ways: the plugins disable command, a setting under enabledPlugins, a server-side switch read once per session, or an installed plugin whose hook sits above this one and overrules the refusal. A session where no hooks module loads leaves the check off entirely. None of that makes the fix useless. It makes it a partial guardrail whose coverage a user should understand rather than assume.
The fix also breaks calls that never leave the machine
The same simplicity that limits the fix also makes it overreach. Issue 107144, filed November 4, 2026, reports that the 2.1.317 check denies local-only Bash calls in headless runs, because the test matches two words anywhere in the input, including text inside a file being written. A heredoc that writes a local note.md containing the address and a URL is denied. A curl to 127.0.0.1, loopback traffic that cannot leave the machine, is denied. In headless runs there is nobody to answer the check's question, so the call is denied and the run carries on. The README accepts these false refusals for simplicity, and the same trade-off cuts both ways: a check that cannot tell a command that sends the address from one that merely mentions it will block innocent work and still miss the leak when it arrives in a shape the check does not recognize.
What to do if you run Claude Code
First, check the version. The privacy mod shipped in 2.1.317, so anything older has no deterministic check at all, and the November 5 report shows that even 2.1.318 does not close every path. Second, check that the mod is actually on, with the plugins command, and remember that a server-side switch or an installed plugin hook can overrule it. Third, do not treat the mod as a boundary. Anthropic's own word for it is courtesy, and the README's pass list is the authoritative statement of what it does not cover. If your work involves web research through the agent, assume the address can leave through the web tools, because nothing in the mod watches them.
One user on the thread reported a workaround that others can copy, with the caveat that it is a user suggestion rather than Anthropic guidance: a rule in CLAUDE.md stating that the email address may appear in a User-Agent header only for an approved site whose policy explicitly asks for one, and that any other site requires asking first. That is a prompt-level instruction, and like all prompt-level instructions it depends on the model following it. The durable fix is the one Anthropic's own contributor pointed to: deterministic checks around model behavior, which is why the gaps in this one matter more than the fix itself.
The deeper question is who verifies what an agent sends on your behalf. An agent that can browse, run shell commands, and call tools is an agent that can disclose your identity to strangers while doing exactly what it was asked to do. Our comparison of the emerging agent identity stack looks at who verifies an agent, what credential it carries, and who is liable when it acts, and the email leak is a concrete case of why that stack exists: without it, the only thing standing between your address and a stranger's server log is a model deciding, in the moment, whether a site's policy outweighs your privacy.
By ByteHerald Staff. GitHub issue 107757 in anthropics/claude-code, November 5, 2026, reported that Claude Code version 2.1.318 on macOS put the signed-in user's email into the User-Agent header during web searches, with the reporter attributing dozens of scam emails a day to the leak. GitHub issue 81138, July 25, 2026, first reported that Claude Code injects the account email into the model's system prompt without consent or disclosure, and remains open. GitHub issue 107144, November 4, 2026, reported that the 2.1.317 privacy check denies local-only Bash calls in headless runs, including a heredoc file write and a curl to 127.0.0.1. Claude Code release v2.1.317, published November 3, 2026, added a check that asks before a web or shell tool call sends the account email address to the network. The cc-plugin-privacy README in the public claude-code repository states the check covers one shape, calls it a courtesy rather than a boundary, and lists the leak shapes that pass, including WebFetch and WebSearch calls and curl -u basic auth. An independent test of the published mod code, published on dev.to in November 2026, ran the code 23 times and found it blocks the exact reported leak while eight other shapes pass. Emergent.sh reported on October 24, 2026, that security researcher Chris Lakin shared findings showing Claude Code inserting user email addresses into outbound HTTP request headers.
Comments
Post a Comment