Claude Code email leak: User-Agent headers exposed accounts

claude code email exposure hit the front page of Hacker News on November 5, 2026, when issue 107757 and the thread "Claude Code sends your email address to websites" climbed to roughly 1,168 points and 364 comments. Our X counts for Claude Code plus User-Agent / email-address queries totaled about 278 posts over seven days, with almost no volume until late November 5 UTC, then roughly 8–40 matching posts per hour into the morning of November 6. Below is what Anthropic staff said on that thread, what the release notes ship today, what older GitHub reports already showed, and what a small team should do before the next coding-agent run with network access.

What leaked, and why

Account email in model context

On the Hacker News thread, Anthropic engineer Lydia Hallie wrote that users had reported Claude hallucinating names for things like `@author` tags because it lacked account context. Anthropic therefore added the signed-in account email to the model's context for signed-in users. When Claude wrote a command itself—such as a curl call—it sometimes put that email in the User-Agent as a contact address, because some sites ask agents for a contact (Hacker News).

Hallie apologized on the thread: "I'm sorry we let this happen," and said Anthropic is removing the account email from the context Claude Code gives the model, with that update expected early the following week. Until then, she pointed users to 2.1.317 or later and noted the stable channel was still on 2.1.311 when she posted (Hacker News).

Not a hardcoded header on every request

Commenters and Anthropic staff describe model-chosen headers, not a networking layer that stamps every outbound call. Sites such as Wikipedia and the U.S. Securities and Exchange Commission (SEC) EDGAR APIs ask scripted clients to identify themselves; HN commenters demonstrated SEC-style requests rejecting a default curl User-Agent and accepting one that includes a contact string (Hacker News). TheInjection.dev summarizes the same mechanism: Claude Code builds web requests through shell tools, the model picks headers, and a contact email already in context can land in User-Agent.

Earlier reports and examples

GitHub issue 101659 (opened October 13, 2026) describes a research subagent putting the signed-in user's email into a User-Agent such as `ThaneholdResearch/1.0 (<user email>)` for a Liquipedia URL, even though session context told the model not to send that email to an unrelated service unless the user asked. Issue 107757's reporter claimed dozens of scam emails per day after Claude Code divulged their address in User-Agent headers during web searches; treat that spam claim as the reporter's allegation—we did not verify their inbox (issue 107757).

What Anthropic shipped in 2.1.317

The v2.1.317 release notes (published November 3, 2026) include: "Added a check that asks before a web or shell tool call sends your account email address to the network." On HN, Claude Code developer mpoteat said the team introduced a built-in mod called `cc-plugin-privacy` to block the behavior deterministically, included in 2.1.317 or later, and turn-off-able via `/plugins` (Hacker News).

Hallie and TheInjection.dev both warn the interim check is incomplete: it does not cover every path (for example when Claude writes a script that runs on its own, or tools other than Bash / PowerShell / Monitor User-Agent matches). The lasting fix Anthropic described is removing the account email from context, not only asking before some tool calls (Hacker News, TheInjection.dev).

What we did not verify

We did not reproduce the leak on a live Claude Code install, inspect Anthropic's system prompt, or audit which third-party sites received any address. We did not confirm the original poster's spam volume or that Wikipedia / SEC were the only destinations. Our X and HN numbers are our measurements at fetch time, not Anthropic's. We could not open every linked secondary write-up behind bot walls; facts above are tied to the GitHub issues, release notes, TheInjection.dev summary, and the HN thread we fetched.

What this means for small businesses

If developers or ops staff use Claude Code (or any coding agent) with network tools against customer systems, treat contact identity as sensitive the same way you treat API keys.

1. Update and keep the gate on. Move to Claude Code 2.1.317 or later, leave `cc-plugin-privacy` enabled, and confirm you are not stuck on a stable build older than the check (release notes).
2. Separate agent identity from personal and payroll email. Give agents an alias or role mailbox you can rotate; decide which accounts may be used at all with our agent login permissions prompt.
3. Write a one-page disclosure SOP. Cover: what the agent may put in User-Agent / From headers; which domains are allowlisted; who approves exceptions; how to rotate aliases if a leak is found. Draft it with the SOP-from-messy-process prompt.
4. Answer money and security questions before production. Use the go-live security checklist prompt and keep join/leave access tidy with the access provisioning checklist.
5. Assume untrusted pages can steer agents. If the agent reads the open web and can run shell or HTTP tools, run the prompt injection defense prompt and require approval for outbound calls that include identity strings.
6. Grade the written rules and price the oversight. Tighten CLAUDE.md / agent instructions with the prompt grader and weigh review time against automation savings with the AI ROI calculator.

Real-estate brokerages and small agencies that let agents scrape MLS, council, or EDGAR-style filings are exactly the workflows where "put a contact in User-Agent" shows up—so the alias-and-approve pattern matters even when the site is legitimate.

Frequently asked questions

Did Claude Code send my email to every website?

Anthropic staff and secondary summaries describe model behavior when a contact was useful for a request, not a default header on every call. Hallie said it sometimes appeared when Claude wrote curl-style commands and sites asked for a contact (Hacker News). Still treat any past network-enabled session as potentially disclosing the account email until you upgrade and rotate aliases.

Is the bug fixed?

Partially. 2.1.317 adds an ask-before-send check for web or shell tool calls that include the account email (release notes). Anthropic said removing the email from model context ships in a following release (Hacker News). Hallie noted remaining gaps such as scripts Claude writes and runs itself.

Why was my email in the model context at all?

Per Hallie on HN, Anthropic added it so Claude would stop hallucinating author/attribution names for signed-in users (Hacker News). That design choice is what made the address available for outbound headers.

Could git or files still expose an email after Anthropic removes the account address?

Yes. HN commenters note `git log` and project files often contain committer emails. Deterministic allowlists and network approval remain useful even after the account-email context change (Hacker News).

What should a small team do this morning?

Update Claude Code past 2.1.317, keep the privacy mod on, switch agent accounts to aliases, require approval for identity-bearing outbound requests, and document the policy with the prompts linked above.

Sources

• Hacker News: Claude Code sends your email address to websites
• GitHub: Bug Report Privacy violation in User-Agent header #107757
• GitHub: Subagent sent the user's email in a User-Agent header #101659
• Claude Code release: v2.1.317
• TheInjection.dev: Claude Code User-Agent email leak

How we report: every fact, number and quote above comes from the linked sources, which we read before publishing. Product details can change quickly during previews, so check the vendor page before you buy. Spotted an error? Tell us via the link on our home page.