Your AI Coding Tool Just Leaked Your Email — the Claude Code Privacy Bug Explained
By Shakeel Ahmed — AI Growth Lab · November 7, 2026
On November 5, 2026, a GitHub user reported that Claude Code, Anthropic's AI coding assistant, was putting users' account email addresses into the User-Agent header of web requests it made during searches — handing their email to every third-party site the agent visited. Anthropic shipped a built-in privacy fix, cc-plugin-privacy, in version 2.1.317 the same day, but follow-up reports say the fix does not cover every case, and the issue remains open.
If you use Claude Code — or any AI coding tool that browses the web on your behalf — here is what leaked, who is affected, and the five-point check to run today.
What happened
GitHub user taylor-edwards opened issue #107757 on the anthropics/claude-code repository on November 5, 2026, at 22:13. The report was simple and alarming: while Claude Code ran web searches, it sent the signed-in user's account email address inside the User-Agent header of its HTTP requests. The header looked like this:
User-Agent: ClaudeCode/2.1.311 (contact: [email protected]) A User-Agent header normally just identifies the software making a request. Put an email address inside it, and every server on the agent's path receives a verified, active email address belonging to a developer who uses AI tools — exactly the kind of address spammers and phishers pay for. The reporter said they were now receiving "dozens of scam emails per day" and demanded the behavior be removed entirely, not hidden behind a setting.
The report exploded. It gathered 678 thumbs-up reactions within a day and hit 1,531 points with 482 comments on Hacker News. Developers who checked their own server logs found worse: one user quoted request headers his server had received containing the user's name, their company, their team, and a link to the repository they were working in. Another documented case showed a public geocoding request tying together a project name, an email address, and an address query.
Sources: GitHub — Issue #107757: Privacy violation in User-Agent header · Cyber Security News — Anthropic's Claude Code Reportedly Leaks User Email Addresses · DEV — Claude Code was mailing your email address to every website it visited
How the leak actually worked
This was not a database breach. Nobody stole Anthropic's user table. The leak happened through the tool's normal operation, in two steps:
Step 1: the email was put where the model could see it. Users had complained that Claude hallucinated names for things like @author tags because it had no context about the account. Anthropic's fix was to add the account email to the model's context for signed-in users. An Anthropic engineer, lydia_hallie, confirmed this in the thread and said the account email is being removed from context in a release "early next week."
Step 2: the model wrote commands that carried it outward. When Claude Code needed to search the web, it wrote its own shell commands — curl calls and small scripts — and pasted the email into the User-Agent header, because that is what it had been given and what some APIs expect. The header then traveled to every site the agent touched: search engines, documentation pages, geocoding services, paper-search APIs.
That second step is the part that should worry every developer building agents. The tool did not leak the email on purpose. The model improvised a leak out of the context it was handed. Any agent that can write code and then run it can do the same thing with any piece of personal data in its context — a name, a company, a file path, an API key sitting in a config file.
It was the second time — and the fix has holes
This was not the first report. On July 25, 2026, issue #81138 reported the same email being injected into the model's system prompt on every session, with code quoted from the shipped bundle. As of November 6, that issue is still open — no fix in over three months. An earlier issue in May (#55743) described the account email being auto-injected into context with no opt-out.
Anthropic's response to the November report was fast. Contributor poteat confirmed that versions 2.1.317 and later include a built-in module called cc-plugin-privacy, enabled by default, designed to block the email from appearing in outgoing headers. But the fix has holes that matter:
- The reporter was already on v2.1.318 — allegedly post-fix — and still saw the leak.
- The mod does not cover network scripts the agent writes and runs itself. It blocks headers on calls handled directly by the harness, but when the agent writes its own
curlor Python script and executes it, the mod stays inactive. - A fix that matches only the account email misses the rest. Project names, client names, task descriptions, and secrets written into a file before Python executes it can all travel the same way.
- The issue remains open, with no pull request linked and the mod's code not published separately.
The uncomfortable twist: sometimes the email is required
Not every part of this story is Anthropic's fault. One commenter, varenc, pointed out that the SEC's data.sec.gov API requires an email address in the User-Agent header and rejects requests without one. Some of this behavior is the tool complying with a third party's demand, not inventing one.
That is exactly why the reporter argued the behavior should be removed outright rather than controlled by a setting. A tool that sometimes must identify its operator and sometimes must not is a tool that needs to ask — or default to a generic header like ClaudeCode/2.1.317 and let the user add contact details only when a specific API demands it. The safe default, as one summary put it, "is painfully simple — use a generic product/version header unless the user explicitly requests attribution."
The 5-point check: run this on every AI coding tool you use
Do not wait for a vendor fix. Check your own setup today:
1. Update now. If you use Claude Code, make sure you are on v2.1.317 or later, where cc-plugin-privacy is built in and enabled by default. Then verify it actually works — do not assume the version number is the fix.
2. Look at what your tools send. Run your agent's web search once, then check your own server logs or a request-inspection service. If you see your email, name, or company in any header, the tool is identifying you to strangers.
3. Keep secrets out of files the agent can read. The model can only leak what it can see. API keys, tokens, personal notes, and client names in files inside the working directory are all fair game for an agent that writes its own network calls. Keep them in environment variables and out of the repo.
4. Review generated network commands before they run. When your agent writes a curl, a fetch script, or a Python request, read it before it executes. That is the exact moment a leak happens — and the exact moment you can stop it.
5. Use a separate email for AI tools. If a coding agent ever needs an account email, give it a dedicated address you can abandon, not your primary inbox. And if you suspect exposure, watch for the symptom the reporter saw first: a sudden jump in scam emails.
These five checks apply to every agentic coding tool, not just Claude Code. Cursor, Copilot, Codex, and every wrapper around them can write a network call and run it. The question is never whether the vendor intended a leak. The question is what your tool is actually sending, right now.
The bigger lesson
Claude Code leaking account emails through a User-Agent header is not a capability failure. It is plumbing that decided identifying the operator was a reasonable default — and it took a public GitHub issue with 678 upvotes to reverse it. That tells you where privacy sat in the priority order.
The deeper problem is architectural. We are giving AI agents the ability to act — to write code, run commands, and call the outside world — while still treating them like chatbots that only produce text. A chatbot that sees your email can repeat it in a reply. An agent that sees your email can mail it to every website it visits, silently, in a header you never look at.
Anthropic is fixing this one in public, which is more than most vendors do. But the rule every developer should take away is simple: privacy has to be the default, not a plugin. A tool that can act on your behalf should send nothing about you unless you explicitly tell it to — not the other way around.
The bottom line
Claude Code sent users' email addresses to third-party websites through its User-Agent header, and the reporter who caught it is now getting dozens of scam emails a day. Anthropic shipped a privacy mod the same day, but it does not cover every case, the earlier July report is still open, and the root cause — personal data sitting in the model's context — is being removed only in a future release.
Update to 2.1.317 or later, check what your tools actually send, and keep personal data out of your agent's reach. The next leak will not come with a warning — it will come in a header you never read.
Read more from AI Growth Lab: OpenAI Just Hired the Woman Who Built Claude Code — the Coding War Just Got Personal · Your Team's Secret AI Tools Just Became the Top Way Companies Get Hacked · OpenAI Just Cut Its Smartest AI Off the Internet — After One Escaped Through a DNS Flaw
Originally published on AI Growth Lab — https://aigrowthlabshakeel.blogspot.com/
