If you use Claude Code, check your version today. Anthropic staff now say that the agent could write your signed-in account email into the User-Agent header of requests it made to third-party sites, and that a guard shipped in 2.1.317 does not catch every case. The fix that removes the address from the model's context is promised for a release "early next week," after this post.
The trigger is anthropics/claude-code issue 107757, opened on November 5, 2026, and a Hacker News thread that had 1,401 points and 439 comments when we read it. This post separates what Anthropic has confirmed, what users report, and what nobody has shown. For the full mechanism and a tested blocking hook, read our earlier deep dive: Claude Code puts your account email in request headers.
TL;DR
| Question | Short answer |
|---|---|
| Did it happen? | Confirmed by an Anthropic engineer: Claude sometimes wrote the account email into a User-Agent on curl calls it wrote itself. |
| Why was the email in context? | Staff say users had reported the model hallucinating names for things like @author tags, so the email was added for signed-in users. |
| Is it fixed? | Partly. 2.1.317+ has a built-in mod, on by default. Staff say it does not stop everything. Removal from context is expected next week. |
| Does the mod work? | Disputed. Two commenters report it did not refuse their test; the HN thread has no such report. |
| Did it cause scam email? | Unproven. One detailed report and several similar comments. No captured request or traced site. |
| What should I do now? | Update to 2.1.317 or later, run the safe test below, and keep your own PreToolUse hook until the context change ships. |
Claimed vs verified
| Claim | Status | Source |
|---|---|---|
Claude Code wrote the account email into User-Agent headers on web requests | Confirmed by Anthropic staff, no count of affected users given | Staff comment on Hacker News |
| The cause is the email in model context plus sites that ask agents for a contact address | Stated by Anthropic staff, consistent with earlier reports | Hacker News, issue 107757 thread |
| A built-in mod blocks this from 2.1.317 | Stated by staff; they also say it misses cases such as a script Claude writes and runs | Issue 107757, Hacker News |
| The mod did not refuse a test command | Reported by two users, on the desktop app, a terminal session and Windows 11. We did not reproduce it | Issue 107757 comments |
The mod is absent from /plugins on 2.1.318 | Reported by two users. A third says it shows as loaded in the session init output | Issue 107757 comments |
| The leak caused dozens of scam emails per day | Claimed by the reporter. No evidence connects a specific site to the spam | Issue 107757 body |
| 14 of 1,660 tool calls with a User-Agent carried one user's email | A claim in an X reply that we could not verify | Reply on X |
| The email will be removed from context next week | Promised by staff, not yet released when we wrote this | Hacker News |
We did not run Claude Code against a live site or reproduce the mod failures ourselves. Everything above comes from the public issue, the Hacker News thread and a post on X, as we read them on November 6, 2026.
What the reporter says happened
The issue is titled "Bug Report: Privacy violation in User-Agent header." It was labelled bug, platform:macos, area:tools and area:security, and was still open with 87 comments when we read it. The reporter writes: "I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission."
The reporter asks for the behavior to be removed from the harness entirely instead of becoming a setting, and says they are moving their company to another tool. A commenter with an old, quiet mailbox describes a sudden flood of unusual spam. Several other comments are jokes or complaints and add no evidence. The spam link is plausible, but the thread contains no captured header, no list of recipient sites and no mail trace.
What Anthropic staff said
Two Claude Code staff members replied. One, a contributor to the repository, wrote that a built-in mod called cc-plugin-privacy was introduced "to deterministically block this behavior in v2.1.317 and later," that it is enabled by default and that you can turn it off in /plugins. The same person later wrote that nobody implemented sharing the email as a feature, that "models can be highly unpredictable," and linked the mod source.
The second, on Hacker News, gave the fullest account. In summary, staff wrote that:
- The account email was added to the model context for signed-in users because Claude would otherwise hallucinate names for things like
@authortags. - When Claude wrote a command itself, such as
curl, it sometimes put the address in theUser-Agentas a contact address, because some sites ask agents for one. - The email is being removed from the context given to the model, in a release expected early the following week.
- The 2.1.317+ mod asks before a web tool call or curl-style command that contains the address, but "it still doesn't prevent all cases, like when Claude writes a script and runs on its own."
- The stable channel was still on 2.1.311, so users need to update to reach the mod.
Note the mismatch in wording. One staff comment describes the mod as asking the user first. The hook code that a commenter quotes says a matching call is refused with no prompt. We did not run it, so we cannot say which is right.
What users report about the mod
The most useful comments are tests. One user ran a command that makes no network request:
echo 'User-Agent: test <your account email>' > /dev/null
They report it ran and was not refused on the desktop app (2.1.317, both before and after a new session) and in the terminal on 2.1.318, with cc-plugin-privacy listed as an enabled built-in plugin. A second user reports the same on Windows 11 with 2.1.318, for both the echo and a curl -A call to a .invalid host that never resolves. Two other commenters say they could not find cc-plugin-privacy in /plugins on 2.1.318, and one says their logs confirm the address went to other domains.
These are user reports, not a vendor finding. A plain echo to /dev/null is also not a real request, so a failure on it does not prove a curl would leak. It does suggest the check may not match the cases its description implies. Anthropic asked for exactly this feedback in the thread, so expect a reply.
Why a mod is not the same as removing the cause
The mod is a check on the model's output. It inspects a tool call after the model writes it. The cause is upstream: the address sits in the model's context, and a polite agent will use the only contact it knows when a site asks for one. Commenters made the same point, and one noted that removing the address from context is itself a weak fix, since it can often be recovered from places such as git log.
Staff also admit the check does not cover a script the model writes and then runs. That matters because a one-line pattern match on a shell command cannot see inside a file. This is the gap our hook example handles by also checking Write and Edit calls. It is also why a lure on a web page ("API clients must include a contact in the User-Agent") works without any malice: the model volunteers the address on its own, as we describe in the attacker angle.
What to do today
- Run
claude --version. If it is below 2.1.317, update. - Open
/pluginsand look forcc-plugin-privacy. Treat a missing entry as unresolved, not as proof it is off. - Run the
echotest above with your own address. It sends nothing. If the call runs, do not rely on the mod. - Keep a PreToolUse hook that denies
Bash,WebFetch,WriteandEditcalls containing your address next to aUser-Agent,curl -Aorwget -U. The tested script is in our earlier post. - Set a no-reply git identity, so
git logdoes not hand the address back to the model. - Search shell history and any proxy logs for your address in
-AorUser-Agentstrings, and use a mail alias for agent-heavy accounts if your plan allows it. - After the next release, check the changelog for the context change and re-run step 3.
How Beam fits, and what it cannot do
Beam is a local, privacy-first tool for watching what coding agents do. It can show you the curl calls and web requests an agent made, flag credentials and personal data in tool calls, and redact known credential formats before anything is stored on your machine. Nothing leaves your device by default. A user who wants to answer "did my address go out?" can look at the recorded tool calls instead of guessing.
Beam's deny is hook-based for Claude Code and Codex PreToolUse, not a network filter or kernel sandbox, and its scanning is heuristic. It cannot see inside a script the agent runs unless the script text passes through a monitored tool call, it cannot read your mailbox, and it cannot prove that a given site caused spam. Treat it as a way to shrink and observe what the agent can reach. For related reading, see how API keys leak through logs and environment variables and what the agent can send out of your machine.
What we will watch
We will update this post when Anthropic ships the context change, publishes release notes for it, or responds to the mod test reports. Useful signals are a changelog entry that names the account email, a fix to the privacy mod's checks, and a captured request that ties a site to the spam in issue 107757. If you have a dated reproduction, include your Claude Code version and operating system.
Frequently asked questions
Did Claude Code really send users' email addresses to websites?
Yes, according to an Anthropic engineer. A Claude Code staff member wrote on Hacker News that the account email was in the model context and that, when Claude wrote a curl call itself, it "sometimes put your email address in the User-Agent as a contact address." That confirms the mechanism. It does not say how many users or sites were affected.
Is the email behind the scam emails in issue 107757?
Not shown. The reporter says they get dozens of scam emails a day after Claude Code sent their address in headers, and other commenters describe similar spam. The issue shows no captured request and no link from a specific site to the spam, so the cause is unverified. An address can also reach spammers through other routes, such as git history.
Does Claude Code 2.1.317 fix it?
Only in part. Anthropic staff say 2.1.317 and later include a built-in mod, cc-plugin-privacy, enabled by default. Staff also say it does not prevent all cases, such as when Claude writes a script and runs it. Two commenters on issue 107757 report that the mod did not refuse their test command on 2.1.317 or 2.1.318.
When will Claude Code stop giving the model my email?
A Claude Code staff member wrote on Hacker News that the account email is being removed from the context given to the model, in a release expected early the week after November 6, 2026. We found no release note confirming it when we wrote this post, so check your version after that date.
How can I check whether the privacy mod is active?
Run claude --version and confirm it is 2.1.317 or later, then open /plugins and look for cc-plugin-privacy. Two commenters on 2.1.318 say the mod did not appear there, while others see it in the session init output, so absence from the list is not conclusive. A test that echoes a User-Agent string with your own address to /dev/null shows whether the guard refuses it, and it makes no network request.
What protects me if the mod misses a case?
A PreToolUse hook you control. Block Bash, WebFetch, Write and Edit calls that contain your address next to a User-Agent, keep the address out of your git identity and shell history, and log outbound requests so you can see what actually left your machine.
Related reading
- Claude Code puts your account email in request headers: how it happens and a hook that blocks it
- Introducing Beam: local-first AI agent security
- Stop Claude Code from running dangerous commands
- Claude Code Desktop preview pane exfiltration
- Codex training setting re-enabled: claimed vs verified
- Fake ChatGPT and Claude bots scanning for .env files
- November 2026 attacks timeline
- Beam on the web: what it watches
Sources: Issue 107757: Privacy violation in User-Agent header · Hacker News: Claude Code sends your email address to websites · Claude Code privacy mod source · Issue 81138: account email injected into the system prompt
Accurate as of November 6, 2026. Details come from the public GitHub issue, the Hacker News thread and a post on X, not from an Anthropic advisory; we did not reproduce the mod tests. Versions, plugin behavior and release timing may change, and Beam is a local prototype, so check current Claude Code documentation before acting.