Claude Code exposed developers' email in web searches via User-Agent

What the issue describes

On November 5, 2026, user taylor-edwards opened issue #107757 in the anthropics/claude-code repository on GitHub, reporting that the tool included the user's account email address in the User-Agent HTTP header of requests made during web searches, without consent. The email reached arbitrary third-party sites every time the agent triggered a search.

I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission.

taylor-edwards, author of issue #107757 in the anthropics/claude-code repository

The original report was made on Claude Code version 2.1.318, running on macOS inside a tmux session. The leaked value was exactly oauthAccount.emailAddress, read from the ~/.claude.json file, that is, the email linked to the Anthropic account of whoever uses the tool, as later confirmed by KardKuro's test on Windows. The issue gathered more than 360 agreeing reactions in less than 24 hours, a rare volume for the repository.

Anthropic's response within hours

Still on November 5, poteat, a collaborator listed in the repository, replied announcing that an internal plugin called cc-plugin-privacy had already been introduced to deterministically block this behavior starting from version 2.1.317.

We introduced a built-in mod called cc-plugin-privacy to deterministically block this behavior in v2.1.317 and later - definitely let us know ASAP though if there's a gap in the checks introduced by that mod.

poteat, collaborator in the anthropics/claude-code repository

The detail that irritated part of the community: the mod comes enabled by default, but can be turned off with the /plugins command. For whoever opened the issue, this doesn't solve the underlying problem: the original request was that sending the email be removed from the harness's code, not turned into an option that someone can disable without realizing the risk.

The patch didn't hold up on Windows

The following day, November 6, user KardKuro tested the same scenario on Windows 11, with the native build via npm of Claude Code 2.1.318. The cc-plugin-privacy@builtin plugin appeared loaded in the system's plugin list, but it didn't block either of the two calls tested inside the Bash tool:

echo 'User-Agent: test <account email>' > /dev/null
curl -s -m 3 -A "test <account email>" http://leak-test.invalid/

According to the report, the behavior expected by the very rule defined in mods/privacy/hooks/register.ts was to deny execution in both cases. In practice, the echo ran normally and curl only failed because the .invalid domain is designed to never resolve, not because of the privacy block. There was no confirmation prompt or refusal for either of the two commands.

As a mitigation, KardKuro started using a custom PreToolUse hook with the same rule (detecting the account email next to the word User-Agent, or flags such as curl -A and wget -U), also covering Write and Edit to catch a script that writes the address into the UA before it's even executed.

Why this matters for everyday Claude Code users

Claude Code is an agent that runs with access to shell, network, and search tools within the development workflow itself. This changes the severity of the problem: the leak doesn't depend on an explicit action by the developer, it happens silently whenever the agent decides to perform a web search as part of a coding task.

For those using a personal or corporate account linked to Anthropic, every search call triggered by the agent became, until the patch, an opportunity to leak PII (personally identifiable information) to third-party servers that have nothing to do with the project being developed. A comment on the issue sums up the legal risk this represents for Anthropic:

Anthropic may not care about its users, but I would think it cares about lawsuits. And this has class action lawsuit written all over it.

phatstackzdevops, comment on issue #107757

The distrust already shows up in concrete decisions: the issue's own author said his company is migrating to the Pi harness (pi.dev) combined with OpenRouter. Other participants recommended open source alternatives such as pyrate, by markuman, or the box project, by jegly, geared toward Android, all as ways to run a code agent without depending on the telemetry of a closed harness.

What remains open

As of publication, Anthropic had not issued an official statement beyond poteat's response on GitHub itself, and there is no registered CVE for the case. Points that remain unanswered:

• Whether the definitive fix will remove the email sending from the code entirely, as requested in the original issue, instead of relying on a plugin that can be disabled.
• Whether the same gap identified on Windows also affects the native build on Linux, since public tests so far cover only macOS and Windows.
• How long this behavior had existed before someone reported it: the issue doesn't provide this information, and Anthropic hasn't disclosed it.

Anyone using Claude Code on a version earlier than 2.1.317 should update immediately, but KardKuro's test shows that updating alone is no guarantee. Until Anthropic confirms the fix, a custom PreToolUse hook that blocks the account email in network headers, like the one published in the issue, is the most concrete mitigation available for those who don't want to switch harnesses.