Claude Code sent users' email addresses to websites: why it happened, what the fix covers, how to block it

On 5 November 2026 a Claude Code user opened GitHub issue #107757, "Privacy violation in User-Agent header". They wrote that Claude Code had put their email address in the User-Agent header of web requests it made while searching, without asking, and that they now get dozens of scam emails a day. Four minutes later it was posted to Hacker News as "Claude Code sends your email address to websites", where it had 1,561 points and 496 comments by 7 November. Other users on the issue say their own logs show the same thing; one counted 53 such calls across 8 of their sessions.

A User-Agent is a short line every web request carries, naming the program that sent it, for example "curl/8.7.1". The website receiving the request usually writes it into its access logs, the record of every request it served. Anything in that line is stored by the site, and by any CDN or proxy (a server that sits between you and the website) in front of it that keeps logs.

Two people who work on Claude Code replied on Hacker News. The first said a built-in mod called cc-plugin-privacy, in version 2.1.317 and later, blocks this. The second, Lydia Hallie, explained the cause, apologised, and said the email address will be removed from what Claude Code gives the model in the next release, "early next week".

This was not new. Issue #81138, opened on 25 July 2026, already reported that the account email is put into the model's prompt without consent. On 7 November both issues were still open.

The model's context is all the text it reads before it writes: the system instructions, your files, the conversation and the results of earlier tool calls. Whatever is in the context, the model can copy into anything it writes, including a shell command. Users had reported that Claude made up names for @author tags in code, because it did not know who you were. So Anthropic put the signed-in account's email into the context.

Now add a second fact. Many sites ask scripts and bots to identify themselves. Wikimedia's User-Agent policy, for example, asks for "some way of contacting you, the operator" and says this "should be given as an email address, a website, or a wiki user". The US SEC goes further: its EDGAR data pages tell automated tools to declare a User-Agent made of a company name and an admin email address, and users on the issue name the SEC as one of the sites that received theirs. A model that has read many such policies, has an email address in front of it, and is writing a curl command, will sometimes do the polite thing and fill it in.

So there was no line of code that sends your email. Claude Code ran a command the model wrote, the same way it runs every other command. That is why the stopgap is a check on what the model writes, and why the lasting fix is to stop giving the model the address at all. Lydia Hallie's reply says the same: the mod "still doesn't prevent all cases, like when Claude writes a script and runs on its own".

Read next: Data exfiltration and egress control for AI agents

Mods are Claude Code's plugin system: code that hooks into events such as "a tool is about to run". Anthropic published the privacy mod's source on 6 November, in the mods/privacy folder of the claude-code repository. It is short. Before a Bash, PowerShell or Monitor call runs, it reads every string in the call's input. It looks for two things. First, your account address, in any case or percent-encoded once (so @ is written as %40). Second, a User-Agent name: User-Agent, user_agent, --user-agent, curl -A, wget -U or UA=. If both are there, the call is refused.

The README is unusually frank about the limits. It calls the mod "a courtesy, not a boundary" that "covers one shape". It lists what passes: the address in a URL, a request body, curl -u or a From header; WebFetch and WebSearch calls and MCP tools, which it does not check; an address computed when the command runs, such as $(git config user.email); a variable; a script file that holds the address; and encodings beyond one pass of percent-encoding.

Two details do not line up, and you should know about both. Lydia Hallie's reply says the mod "asks you before Claude runs a web tool call or a curl-style command containing your email". The published README says the refusal "raises no prompt" and that WebFetch and WebSearch are not checked. The changelog sides with the reply: the 2.1.317 entry, published on 3 November, reads "Added a check that asks before a web or shell tool call sends your account email address to the network". And on the issue, two users on 2.1.318 say cc-plugin-privacy does not appear in /plugins at all, while users on macOS and Windows show it loaded but not refusing a test it should refuse. So the shipped build may differ from the published source, and you cannot assume it is protecting you.

Read next: Claude Code mods, explained: what a mod can see

Issue #81138 was opened on 25 July 2026 and was still open on 7 November. Version 2.1.317, the first that Anthropic says carries the privacy mod, was published on npm on 2 November; 2.1.318 followed on 3 November. Issue #107757 was opened on 5 November at 22:13 UTC and was on Hacker News at 22:17. The mod's source went up at 00:00 UTC on 6 November, and 2.1.319 appeared on npm at 00:58 UTC; it was the latest tag on 7 November, and its changelog says nothing about the email.

The fix that matters, removing the email from the model's context, is promised for the next release, "early next week". When it ships, the scan above should stay at zero from then on, and you can decide whether to keep the hook. I would keep it: the next private value in a context will have the same problem.

Every agent builder should take one rule from this. An AI agent can copy anything in its context into any tool call it writes. If the context holds a name, an email, an API key or a customer record, and the agent can make web requests, then sooner or later some of it can end up in a request. Not because of an attack, but because it looked helpful.

There are three places to stop it, in order of strength. Keep the value out of the context unless the task needs it, which is Anthropic's real fix. Check what leaves, deterministically, at the point where a tool call runs, which is what the mod and the hook do. And limit where the agent can send anything at all, with a network allow-list. A line in the prompt asking the model not to do it is the weakest of all, because the model chooses whether to follow it.

Read next: PII and compliance for LLM apps

The facts come from the two GitHub issues, the privacy mod's README and source at commit 90380efca, the two Claude Code staff replies on Hacker News, the npm registry, Wikimedia's User-Agent policy and Claude Code's hooks reference, all read on 6 November 2026, re-checked on 7 November, and linked below.

I did not reproduce the leak itself: that would mean asking the model to fetch websites while signed in and hoping it misbehaves, and sending a real address to real sites. I tested the published check, not the shipped build, and the user reports quoted above suggest they may differ. I cannot verify the reporter's link between the leak and their spam. The scan of this Mac covers only the logs it still keeps.