Claude Code Sent Your Account Email to Websites in Its User-Agent Header. The Fix Is a Guard That Asks First, and It Misses Scripts Claude Writes Itself.
A GitHub issue opened November 5 says Claude Code wrote the signed-in account email into the User-Agent header of web requests during searches. Claude Code 2.1.317, released two days earlier, added a check that asks before a web or shell tool call sends the account email, shipped as a built-in privacy mod that is on by default and can be turned off. The catch is that the email is still handed to the model as context, which Anthropic says was done to stop invented names in author tags, so a script Claude writes and runs can bypass a command-level check, and a commenter showed the header can carry project and task names too. Removal from context was promised on Hacker News and is absent from the 2.1.319 notes. We read the issue and the release notes.
By T.W. Ghost
A bug report opened on the Claude Code repository today, November 5, 2026, at 4:13 PM Central, titled "Privacy violation in User-Agent header." The reporter, on version 2.1.318 on macOS, says Claude Code put their signed-in account email into the User-Agent header of web requests it made during searches, without asking, and blames the leak for dozens of scam emails a day. The causation is the reporter's claim. The mechanism is not in dispute, and by the end of the week the thread had 106 comments and a Hacker News discussion past 1,500 points.
The fix had already shipped, two days before the report. Claude Code 2.1.317, published November 3, "added a check that asks before a web or shell tool call sends your account email address to the network." A maintainer-associated account says it ships as a built-in privacy mod, on by default, and can be turned off in the plugins menu. What has not shipped is removal. By the Claude Code team's own account on Hacker News, relayed secondhand, the email was put into the model's context deliberately, to stop Claude from inventing names in author tags, and the guard does not catch every path: a script Claude writes and then runs is not a web or shell tool call the guard inspects. The team said the email comes out of context "in the next release." The 2.1.319 notes, published November 6, do not say that. We read the issue, the release notes for 2.1.317 and 2.1.319, and the Hacker News relay. Here is what held up.
What Happened, and What Shipped
| Claude Code account email in User-Agent | |
|---|---|
| Report | GitHub issue 107757, opened Nov 5, 2026, 22:13 UTC; reporter on 2.1.318, macOS; 106 comments by Nov 8 |
| Behavior | Account email written into the User-Agent of web requests during searches |
| Why the email was there | Added to model context to stop invented names in author tags (Claude Code team on Hacker News, secondary) |
| Fix shipped | 2.1.317, Nov 3, 01:25 UTC: asks before a web or shell tool call sends the account email |
| Delivery | Built-in privacy mod, on by default, can be disabled in the plugins menu (maintainer-associated comment) |
| Gap | Scripts Claude writes and runs are not caught by the command-level check (team on Hacker News, secondary) |
| Also in the header | Model-invented product tokens naming project, client, or task, per a commenter |
| Stable channel | Was on 2.1.311, before the guard, per the relay |
| Removal from context | Promised "in the next release" on Hacker News; not in 2.1.319 notes (Nov 6) |
| Scam-mail causation | Reporter's claim, unverified |
A guard is not a removal. The model still knows your email. The guard watches two kinds of tool call and asks before they send it. Anything else the model does with the string, including writing it into a script that then runs, is outside the check, by the team's own description.
The header carried more than the address. One commenter's traces show a made-up product token next to the email naming the project, client, or task. An identity plus a description of the work is a better phishing seed than either alone.
The off switch cuts both ways. A mod that users can disable is a mod an enterprise has to verify stays on. Check the plugins menu on managed machines.
Stable lagged the fix. If the relay is right that stable was on 2.1.311, the users least likely to be on the bleeding edge were the ones without the guard.
Verified vs Unconfirmed: The Scorecard
| Claim | Verdict |
|---|---|
| Issue 107757 opened Nov 5; reporter's version and platform; comment count | Verified (GitHub) |
| Email appeared in User-Agent during searches | User report; mechanism acknowledged by the fix |
| 2.1.317 added the ask-before-sending check; published Nov 3 | Verified (release notes) |
| Privacy mod on by default, can be disabled | Verified (maintainer-associated comment) |
| Email added to context to stop invented author names; scripts bypass the guard; stable on 2.1.311; removal next release | Secondary (Hacker News quotes via relay) |
| 2.1.319 notes say nothing about removing the email from context | Verified (absence) |
| Project and task names in the header | User report |
| Scam email caused by the leak | Unverified |
What To Do
Update to 2.1.317 or later, 2.1.319 is current, and confirm the privacy mod is enabled in the plugins menu, on every machine, especially managed ones.
Search your own transcripts under the Claude projects directory for your email in outbound commands, and treat anything in agent context, email, paths, repository names, as something that can leave the machine.
The frontier is elsewhere: this is the second Claude Code trust story in a week after the Cursor marketplace backdoor, and the first where the leak was by design. Our model comparison has the current standings side by side.
Sources
- GitHub: anthropics/claude-code issue 107757, privacy violation in User-Agent header
- GitHub: Claude Code release v2.1.317
- GitHub: Claude Code release v2.1.319
- Code415 Radar: Hacker News quotes from the Claude Code team (secondary)
*Not sure what your coding agent knows about you and where it sends it? Take the free 2-minute quiz and get matched. Then read about the feature that stores your conversations server-side for five minutes: Claude message threads.*