Developers have found that Claude Code writes the signed-in user's email address into the User-Agent header of web requests, sending it to the third-party sites it visits. On November 5, a user named taylor-edwards filed an issue in Claude Code's GitHub repository, saying they now receive large volumes of scam email every day and that their company will switch to a combination of Pi and OpenRouter.
The reporter was running version 2.1.318 on macOS. Within a day the report had drawn nearly 90 comments and more than 600 upvotes.
How the email got out
According to Anthropic staff and the comment thread, the cause was a change that looked harmless. To stop the model from inventing author names in fields such as the author line of code comments, Claude Code placed the signed-in account's email into the model's context.
When the model wrote its own curl commands to fetch web pages, it treated that email as a contact address and put it into the User-Agent. Some sites do ask script clients to leave a contact email in the UA, Wikipedia being one example, and the model followed that convention. The result was that the user's email went to whatever site it happened to visit along the way.
Lydia Hallie of Anthropic responded:
"We're removing the account email address from the context Claude Code gives the model."
She also wrote that "this should not have happened, and we should've caught this behavior earlier," and said the change would ship in the next release, expected early next week. As of publication that version was not yet out and the issue remained open.
Putting the timeline together
The problem dragged on for months. Based on the comments and press coverage:
- July: a user had already filed issue 81138 on GitHub, and commenters believed it described the same behavior;
- Version 2.1.317: Claude Code shipped a built-in privacy plugin called cc-plugin-privacy, enabled by default, which asks the user before a web tool call or a curl command containing an email is executed;
- November 5: the new report appeared, from a user already on 2.1.318, and the email was still being sent;
- Afterward: Anthropic stated it would remove the email from the context entirely.
From the first report in July to the formal statement in November, roughly three months passed. The earlier patch put a gate at the exit, but the problem was at the entrance: as long as the email remains in the context, the model can carry it out by some other route. Media reports point out that the plugin does not cover cases where Claude writes a script and then runs it. Some users in the comments also said the plugin never appeared in the /plugins menu, or that it showed as loaded while commands containing the email still ran. These claims cannot be verified for now, and Anthropic has not addressed the specific cases in which the plugin fails.
Another detail concerns release channels. Reportedly, the stable channel was still at 2.1.311 at the time, which did not include even the confirmation gate, so stable-channel users had to upgrade manually to get the plugin.
What you can do now
The community has suggested two stopgaps: use a pre-tool-use hook to intercept commands that contain both the account email and a User-Agent parameter, or state in CLAUDE.md that the email may only appear in requests to specified domains. One developer has already published the first approach in their own configuration repository.
For team users, the exposure depends on the signed-in account. If you log in with a work email, it is the work address that leaks, and phishing messages land directly in the corporate inbox. Which sites received these UA strings and how long their server logs keep them is up to those sites, and Anthropic cannot retract anything on users' behalf.
Sources: Claude Code GitHub issue, CocoLoop, AI Chat Daily, Trending Topics. The issue was checked for the affected version number and the privacy plugin description; Anthropic staff statements are as stated in their public replies.