Is Claude Code Handing Your Email to Every Site It Visits?

Claude Code put signed-in users' emails into User-Agent headers. Sites logged them; scam mail followed. Anthropic shipped a narrow fix—here's what still leaks.

TheTechLane cover on warm parchment: a large open ink-black envelope spills electric-amber User-Agent header text containing an email, with a prominent TL logo stamp and the headline asking if Claude Code hands your email to every site it visits

Claude Code has been putting signed-in users' account email addresses into the User-Agent headers of outbound web and shell requests—so sites that asked for a contact address sometimes got the developer's real inbox instead. A November 5 GitHub issue went viral on Hacker News; Anthropic is racing a fuller fix.

Here's what you need to know:

  • Outbound curl and similar tool calls from Claude Code sometimes sent the signed-in account email in the User-Agent header to third-party sites.

  • Sites such as SEC EDGAR, Wikipedia/Wikimedia, crates.io, and Liquipedia ask scrapers for a contact email; the model reused the only address in context—the user's.

  • A viral GitHub issue (#107757) filed November 5, 2026 by taylor-edwards claimed dozens of scam emails a day; HN blew up November 5–6.

  • Anthropic shipped v2.1.317 with cc-plugin-privacy; staff say account email leaves context in a release early next week.

  • Gaps remain: the mod is narrow, WebFetch/WebSearch/MCP are unchecked, and script-then-run paths can bypass it.

UML sequence diagram showing a signed-in Claude Code session injecting the account email into model context, a Bash curl call putting that email in the User-Agent header, and a third-party site logging it

How Claude Code put account email in User-Agent

What Happened

Claude Code injects the signed-in user's account email into the model's context. Anthropic staff later said that was intentional—to stop the model inventing fake @author tags. The side effect was uglier. When Bash-style tools issued HTTP requests, and a site's docs asked for a contact email in the User-Agent, the model often stuffed the account address into that header.

According to the viral GitHub bug report #107757 opened by taylor-edwards on November 5, 2026, that leak had been producing a flood of scam email—dozens a day in the reporter's case—after Claude Code hit public endpoints. Reports stretch back to roughly July and September 2026. The Hacker News discussion exploded the same day and into November 6.

Anthropic responded on both fronts. On GitHub, staffer poteat pointed at v2.1.317: "Added a check that asks before a web or shell tool call sends your account email address to the network." That release adds built-in mod cc-plugin-privacy. On HN, lydia_hallie said Anthropic would remove the account email from model context in a release early next week, and noted stable was still on 2.1.311—so users need 2.1.317+ for the interim guard.

The privacy-mod README is blunter than the changelog. It refuses Bash, PowerShell, and Monitor calls whose input both contains the account address and names a User-Agent—without prompting. It does not check WebFetch, WebSearch, or MCP. The README calls the guard "a courtesy, not a boundary," and says it "covers one shape." See the privacy mod README and v2.1.317 release notes. Fathom on DEV (November 7) and Gabriel Anhaia on DEV (November 6) tracked the same timeline.

Users already report gaps: the mod may miss documented cases; a script the model writes then runs can bypass the input check; and project names still show up in User-Agent strings.

Why It Matters

Agentic coding tools sit between your identity and the open web. When the agent's HTTP fingerprint carries your personal email, every fetch becomes a quiet disclosure to whoever runs the other end—logs, WAFs, abuse desks, or worse. That is automated, repeated, and easy to harvest—unlike a one-off paste into a chat.

It echoes a pattern TheTechLane has covered before: tools that hold secrets in context can leak them through unexpected channels. The recent Trigger.dev environment-variable breach was about stored env vars; this story is about identity baked into every outbound request.

For enterprises the blast radius is bigger than one inbox. Shared Anthropic accounts, contractor laptops, and CI-style agent runs can stamp a corporate email onto public crawls—inviting phishing, spam, and compliance questions. And the fix shape matters: a mod that only blocks one header pattern in three tools is a seatbelt, not a vault. Pulling the email out of context is the real boundary.

What It Means for Developers

Flowchart of developer actions after the Claude Code email leak: check version, update to 2.1.317 or newer, confirm cc-plugin-privacy is on, then see what the mod catches versus what still slips through

What the privacy mod catches vs what slips through

If you use Claude Code today, treat the email-in-UA issue as live until you verify your build and habits:

  • Check your version. Stable may still be on 2.1.311. Move to 2.1.317+ so cc-plugin-privacy is present—confirm on the official Claude Code changelog.

  • Confirm the privacy mod is on. Built-in from 2.1.317; verify it is active in your install.

  • Do not treat the mod as a firewall. It only refuses Bash/PowerShell/Monitor inputs that both hold the account email and mention User-Agent. WebFetch, WebSearch, and MCP are unchecked.

  • Watch for bypasses. If the model writes a script then runs it, the account email may never appear in the tool input the mod inspects.

  • Prefer a role inbox. Avoid putting personal addresses in prompts; use a dedicated alias for agent work until context removal lands.

  • Audit recent targets. If Claude Code hit SEC EDGAR, crates.io, Wikimedia, or similar sites while you were signed in, assume those logs may hold your address.

  • Stay sharp on Claude Code security. See our earlier report on a Claude Code extension SSH backdoor finding.

What's Next

Anthropic says account email will leave model context in a release early next week—the fix users actually want. Until then: update to 2.1.317+, keep cc-plugin-privacy on, and assume the guard is incomplete.

Open questions remain. Will WebFetch, WebSearch, and MCP get the same treatment? Will Anthropic publish a post-mortem on how long emails were sent and which sites received them? Will stable move off 2.1.311 fast enough?

Watch the GitHub issue thread and the changelog for the context-removal release. Until then, every site Claude Code visits is a potential copy of your login email.

FAQ

Does updating to Claude Code 2.1.317 fully stop the email leak?

No. v2.1.317 adds cc-plugin-privacy, which blocks some Bash/PowerShell/Monitor calls that put your account email in a User-Agent. It skips WebFetch, WebSearch, and MCP, and script-then-run paths can slip past. Removing the email from context—early next week—is the fuller fix.

Why was my email in Claude Code's context at all?

Anthropic staff said the account email was added to stop the model hallucinating @author tags. That made the address available when sites asked for a contact email in the User-Agent.

Should I rotate or abandon the email on my Anthropic account?

Anthropic has not issued a blanket "abandon that address" order. Practical steps: update to 2.1.317+, watch for phishing, and prefer a role inbox until the context-removal release lands.

Sources

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane.

Learn • Build • Share

Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.