Anthropic’s Claude Code has been quietly leaking user privacy into the wild, embedding signed-in account email addresses directly into the User-Agent headers of web requests. The issue, first reported on GitHub issue #107757 on November 5, 2026, at 22:13 UTC, sparked immediate backlash with over 750 reactions and a Hacker News thread surpassing 1,390 points by the following morning. Users reported receiving daily scam emails, tracing the source back to the coding agent’s tendency to include their personal address when constructing curl commands or scripts.

The Technical Root Cause

The leak stems from a design decision intended to improve code attribution. Lydia Hallie, a Claude Code engineer, explained that the model was provided with the user’s email to prevent it from hallucinating fake names in @author tags or other metadata. When Claude wrote its own network calls, it treated the User-Agent header as a place to identify the operator, a practice encouraged by standards like the Wikimedia Foundation’s User-Agent policy and the SEC’s requirements for EDGAR clients. Consequently, a polite, compliant script became a vector for personal data exposure.

Anthropic’s Stopgap: The cc-plugin-privacy Mod

In response, Anthropic released a built-in mod called cc-plugin-privacy in versions 2.1.317 and later. However, this fix is far from comprehensive. By reading the source code published on November 6, we found the mod only intercepts Bash, PowerShell, and Monitor tool calls. It specifically looks for the email address combined with keywords like User-Agent, --user-agent, or UA=. Crucially, it ignores WebFetch, WebSearch, MCP tools, and any scripts written to disk that might contain the address. The README explicitly calls this a "courtesy, not a boundary," admitting it uses simple word matches rather than a robust parser.

Version Discrepancies and Failed Checks

A significant disconnect exists between marketing and reality. While Hallie stated on Hacker News that the mod prompts users before web tool calls, the published source code shows no such prompt for web tools, which are entirely unchecked. Furthermore, users on macOS and Windows reported that even in versions 2.1.317 and 2.1.318, the mod failed to fire, allowing curl -A calls with their email to proceed. Meanwhile, the npm stable channel was still stuck on version 2.1.311 as of November 6, leaving the majority of users completely unprotected.

How to Scan and Block the Leak Yourself

Until the promised fix—scheduled to remove the email from the model’s context early next week—ships, users must take matters into their own hands. You can scan your local session history using a Python script that checks ~/.claude/projects for JSONL files containing both your email and User-Agent strings. For active blocking, Anthropic’s hook system allows you to register a PreToolUse command that rejects any tool call containing your email address in the input. This blunt-force approach blocks the address in any header, body, or file, though it may occasionally flag harmless calls.

Key Takeaways

  • The leak affected Claude Code versions prior to 2.1.317 by default, including the stable npm channel (2.1.311).
  • The cc-plugin-privacy mod only checks Bash, PowerShell, and Monitor calls; WebFetch and MCP tools remain unchecked.
  • Anthropic plans to remove the email from the model’s context in a release expected early next week.
  • Users should manually scan their ~/.claude/projects directory and implement a PreToolUse hook to block email exposure.

The Bottom Line

This incident is a classic case of over-engineering politeness at the expense of privacy. Relying on a 'courtesy' mod that misses the majority of network calls is insufficient for a tool handling sensitive developer identities.

What Is Still Unknown

Anthropic has not provided a count of affected users or requests. It remains unclear if sessions authenticated via API keys rather than claude.ai accounts were also susceptible. Additionally, the discrepancy between Hallie’s description of the mod’s behavior and its actual source code remains unresolved, leaving developers to wonder whether the protection is real or merely a placebo effect.

Final Verdict

Until the context removal is shipped and verified, treat Claude Code as a privacy risk. Disable the email injection if possible, or strictly enforce local hooks that block any outbound data containing your personal address.