← All incidents

Users report Claude Code put the signed-in account email into outbound User-Agent headers on web and tool requests

Incident · Claude Code · MEDIUM

Summary

Open GitHub issues on anthropics/claude-code report the signed-in user's account email appearing in the User-Agent of outbound web and tool requests. The freshest report, issue #107757 opened Nov 5, 2026 at 5:13 PM ET, is titled "Bug Report: Privacy violation in User-Agent header". The reporter, on version 2.1.318 on macOS, wrote that Claude Code "divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches". The same report claims scam mail followed those searches; that is the reporter's claim, not a verified causal link. Earlier open issues describe the same class of leak: #95258 (Sep 17, 2026 ET; email in a User-Agent to crates.io), #101659 (Oct 12, 2026 ET; research subagent User-Agent to Liquipedia), #102577 (Oct 15, 2026 ET; Wikipedia User-Agent), and #102624 (Oct 15, 2026 ET; Auto Mode PII in a User-Agent). Contributor @poteat commented on #107757 at 6:31 PM ET Nov 5 that a built-in mod named cc-plugin-privacy was introduced in v2.1.317 and later to block this behavior, is on by default, and can be turned off via /plugins. This window confirmed via the GitHub contents API that mods/privacy is in the public repo (README.md blob sha d7b565d83edd81c3113a48118025a163518449e7; latest path commit 90380efca7f9d73e206fac453f841b6acd664f4d). Issue comments still report gaps on 2.1.318: one user said the mod was missing (comment 6676028953); macOS and Windows users said it loaded but did not refuse the documented cases (comments 6676218676 and 6680196779). A comment on #107757 (6677044387) quotes a Hacker News post signed lydia_hallie (item 50385272 / kid 50388176) saying the account email will be removed from the model's context in a next release "early next week". That authorship is not independently verified, it is not an Anthropic advisory, and it concerns the model's context, not the outbound User-Agent header, so it is not a fix for the header leak. As of this window, npm dist-tag latest for @anthropic-ai/claude-code is 2.1.319 (registry time 2026-11-06T00:58:56.366Z / Nov 5, 2026, 7:58:56 PM ET); the GitHub release notes for v2.1.319 do not mention removing the account email from model context or closing the User-Agent leak. No CVE or GitHub security advisory for this behavior was found in this window. We did not run a reproduction.

Severity

Timeline

1. Sep 17, 2026, 8:01 PM ET
   Issue #95258 opened: user email from account metadata sent in a User-Agent to crates.io (still open).
2. Oct 12, 2026, 8:41 PM ET
   Issue #101659 opened: research subagent put the signed-in email in a User-Agent to Liquipedia (still open).
3. Oct 15, 2026, 5:02 PM ET
   Issue #102577 opened: email in User-Agent on Wikipedia requests (still open).
4. Oct 15, 2026, 9:31 PM ET
   Issue #102624 opened: Auto Mode sent PII in a User-Agent to a third-party endpoint (still open).
5. Nov 2, 2026, 6:57 PM ET
   npm publishes @anthropic-ai/claude-code 2.1.317 (registry time 2026-11-02T23:57:53.069Z).
6. Nov 3, 2026, 4:55 PM ET
   npm publishes 2.1.318 (registry time 2026-11-03T21:55:17.247Z).
7. Nov 5, 2026, 5:13 PM ET
   Issue #107757 opened: Privacy violation in User-Agent header; reporter on 2.1.318 (darwin); still open.
8. Nov 5, 2026, 6:31 PM ET
   @poteat (CONTRIBUTOR) comments that cc-plugin-privacy in v2.1.317 and later blocks this by default.
9. Nov 5, 2026, ~evening ET
   Hacker News item 50385272 discusses the leak; a reply signed lydia_hallie (kid 50388176) says the account email will leave the model context in a next release early next week. Authorship not independently verified.
10. Nov 5, 2026, 7:58 PM ET
    npm publishes 2.1.319 (registry time 2026-11-06T00:58:56.366Z); release notes do not mention removing account email from context or closing the User-Agent leak.
11. Nov 6, 2026, this window
    GitHub contents API confirms mods/privacy is public; comments 6676028953, 6676218676, and 6680196779 still report gaps on 2.1.318. No CVE or advisory found.

How it happened

Per the open issues, Claude Code gives the signed-in account email to the model in session context. When the agent builds an outbound request, for example a curl call or a fetch to a site that asks API clients for a contact in the User-Agent, that email can be placed in the User-Agent string. Issue #101659 shows a redacted example shaped like: curl ... -A "ThaneholdResearch/1.0 (<user email>)" ... against Liquipedia. Issue #95258 quotes the model admitting it took userEmail from account metadata and put it in a User-Agent to crates.io. Issue #102577 says the email went out in the User-Agent on Wikipedia search requests. The built-in cc-plugin-privacy mod, whose public source under mods/privacy says it refuses Bash, PowerShell or Monitor calls whose input holds the account address and names a User-Agent, is the mitigation named by @poteat. User reports on #107757 say that on 2.1.318 the mod can be missing or can load without refusing the cases its README describes. Separately, the HN post signed lydia_hallie says Anthropic will remove the account email from the model's context in a future release; that is quoted here as an attributed claim only, and it does not claim to rewrite outbound User-Agent handling.

How to check your app

• If you use Claude Code, read the open GitHub issues above and check whether cc-plugin-privacy appears under /plugins on your install.
• Treat any third-party site your agent contacted while signed in as having possibly seen your account email in a User-Agent, and rotate that address or watch it for unwanted mail if that risk matters to you.
• Do not treat npm 2.1.317+ or the privacy mod alone as a full fix: reporters on 2.1.318 said the mod was missing or loaded without refusing.
• Prefer not to run unverified "fixes" from social posts; stick to primary GitHub issue threads and official release notes.

Sources

• GitHub issue #107757: Bug Report: Privacy violation in User-Agent header
• GitHub issue #95258: User email sent in User-Agent header
• GitHub issue #101659: Subagent sent email in User-Agent header
• GitHub issue #102577: User email exposed in User-Agent on Wikipedia requests
• GitHub issue #102624: Auto Mode sent PII in User-Agent header
• @poteat CONTRIBUTOR comment on #107757 (id 6672259159)
• anthropics/claude-code mods/privacy (public source)
• Hacker News item 50385272 (lydia_hallie reply kid 50388176 quoted via issue comment 6677044387)
• npm registry: @anthropic-ai/claude-code
• GitHub release v2.1.319

Corrections and updates

None. Re-checked against every source on Nov 6, 2026.