Anthropic is removing signed-in users' account email addresses from the context Claude Code gives its model, after a developer reported that the coding agent had been sending their email to third-party websites in the User-Agent header of its web requests. The bug report, filed on GitHub on November 5 at 22:13 UTC, had drawn 88 comments and more than 600 thumbs-up reactions by Friday afternoon.
The reporter, GitHub user taylor-edwards, said they were receiving dozens of scam emails per day and blamed Claude Code for sharing their address while it ran web searches without permission. The developer was running Claude Code version 2.1.318 on macOS, and asked that the behavior be removed from the harness entirely rather than offered as an opt-in or opt-out setting. The developer also wrote that they were moving their company to a different agent harness.
“it does nothing for services which dislike agentic traffic, does not preserve my anonymity on the web, and is a goldmine for scammers”— Taylor Edwards, Developer who filed the Claude Code bug report
Anthropic says nobody built email sharing as a feature. A Claude Code contributor posting as poteat explained in the thread that some sites, Wikipedia among them, ask scripted clients to identify themselves with a contact email in the User-Agent. When a user asked Claude to research something on such a site, the model could write a curl command that put the user's own address into that header.
Key facts
- 01A GitHub bug report filed Nov. 5 at 22:13 UTC said Claude Code put a user's email in User-Agent headers sent to websites.
- 02The issue drew 88 comments and more than 600 thumbs-up reactions within a day.
- 03Anthropic says it will remove the account email from Claude Code's model context in the next release, expected early next week.
- 04An interim mod, cc-plugin-privacy, ships on by default in Claude Code 2.1.317 and later; the stable channel is still on 2.1.311.
- 05Users on macOS and Windows reported test commands with their email and a User-Agent string that the mod did not refuse.
Lydia Hallie, who works on Claude Code, explained in a Hacker News post that was reposted into the GitHub thread why the address was in context at all. Users had reported that Claude would hallucinate names for things like @author tags because it had no information about the account, so Anthropic added the account email to the model's context for signed-in users. When Claude then wrote its own commands, it sometimes reused that address as a contact.
“We're removing the account email address from the context Claude Code gives the model.”— Lydia Hallie, Claude Code team, Anthropic
Hallie said the change removing the email will ship in the next Claude Code release, expected early next week. Until then, Anthropic is pointing users to a built-in mod called cc-plugin-privacy, included in version 2.1.317 and later and enabled by default. According to Hallie, the mod asks the user before Claude runs a web tool call or a curl-style command that contains the account email.
Hallie also said the mod does not catch every case, such as when Claude writes a script and runs it itself. She noted that Claude Code's stable channel is still on version 2.1.311, which predates the mod, and advised users to update to 2.1.317 or later. Anthropic published the mod's source code in the Claude Code repository after the report.
“Again, this should not have happened, and we should've caught this behavior earlier.”— Lydia Hallie, Claude Code team, Anthropic
Several users in the thread said the interim check did not work for them. One user on 2.1.318 said the mod did not appear in the /plugins menu and that logs confirmed the address had gone to other domains. Two others, on macOS and Windows, posted test commands containing their account address and a User-Agent string that ran without being refused, even though the mod showed as loaded.
Commenters also pointed to an earlier GitHub issue, number 81138, opened in July, which they said described the same behavior. Some suggested workarounds in the meantime, including custom pre-tool-use hooks that block any command pairing the account address with a User-Agent flag, and instructions in a project's CLAUDE.md file limiting where the address may be sent.
As of Friday afternoon the GitHub issue remained open, labeled as a bug in the security and tools areas. Hallie said she would post an update in the Hacker News thread once the release removing the account email is out.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
