Claude Code is inadvertently broadcasting developer email addresses to external websites, a privacy leak that persists despite recent mitigation attempts. The issue, tracked in GitHub Issue #107757 with over 1,100 points on Hacker News, stems from the model injecting the account email into the context to prevent hallucinated author tags. When Claude writes its own curl commands, it often uses this address in the User-Agent header, effectively handing your contact info to every site it visits without explicit consent.

The Stable Channel Gap and Broken Stopgaps

Developers relying on the stable channel are currently unprotected. As of November 6, the stable release was serving version 2.1.311, while the privacy patch requiring version 2.1.317 was only available on the latest channel. Even users on the latest build face an unreliable defense. The official cc-plugin-privacy module is described in its own README as "a courtesy, not a boundary." It fails to check WebFetch, WebSearch, URLs, and From: headers. Worse, multiple users on version 2.1.318 report that the plugin is either missing from the /plugins list entirely or fails to block simple curl calls, rendering the official fix largely ineffective.

Provenance and Real-World Impact

The leak is not merely theoretical; a site operator confirmed seeing Claude user emails in their access logs for months. While the direct link to increased spam remains unproven, the violation of privacy-by-design is clear. The root cause is a design flaw: Anthropic placed the user's email in the model's context to solve a minor formatting issue with @author tags. This decision meant that any instruction telling the model not to share the emailβ€”such as those added in version 2.1.234β€”could be ignored by the model's own logic when it decides a site requires contact details. Tests by the whoami-guard tool showed an 8/60 leak rate for identity exposure when a site requested contact info, specifically with Haiku models, before the patch.

Mitigation Strategies and Future Fixes

Until Anthropic removes the email from the context entirely, developers must take manual action. The recommended approach involves three steps: upgrading to the latest channel to ensure version 2.1.317+, verifying the privacy plugin is active, and implementing a robust PreToolUse hook. This custom hook, written in Bash, intercepts network calls and blocks any attempt to pass an email address in User-Agent strings or URLs. Additionally, users should switch their Git configuration to use GitHub's no-reply email address to prevent leakage through commit metadata. Anthropic has promised that the next release, expected early next week, will finally remove the account email from the model's context, addressing the root cause rather than the symptom.

Key Takeaways

  • The stable channel (2.1.311) lacks the privacy patch (2.1.317), leaving most users exposed.
  • The official cc-plugin-privacy is incomplete, missing WebFetch, WebSearch, and URL vectors.
  • The leak originates from the email being placed in the model's context to fix author tag hallucinations.
  • Developers should implement a PreToolUse hook and switch to GitHub no-reply emails immediately.
  • Anthropic plans to remove the email from context entirely in a release due early next week.

The Bottom Line

Placing a user's private contact info in the LLM's context window was a lazy architectural decision that prioritized trivial formatting over security. The resulting patch is a band-aid on a bullet wound, failing on both stable and latest builds. Until the email is stripped from the context, Claude Code remains a privacy liability for anyone who values their inbox.