Claude Code put users' account email in web request headers — how to check yours and stop it

A Claude Code user reported on November 5 that Anthropic's coding agent sent his account email address to third-party websites in the User-Agent header while it was searching the web. The report, GitHub issue #107757 on the anthropics/claude-code repo, hit the top of Hacker News with more than 600 points. The reporter, on Claude Code 2.1.318 on macOS, says he now gets dozens of scam emails a day, according to AI TL;DR's summary of the issue.

Why it matters: this isn't a remote attack — it's an agent being "helpful." Some sites, Wikipedia among them, ask scripted clients to identify themselves with a contact email in the User-Agent. If the model has your email in its context, it can decide to put it there when it builds a curl command. Any site you research, and anything in between that logs headers, then has your address.

What's been reported

• Where the email comes from. Reports going back to July (issue #81138, per explainx.ai) say Claude Code adds the signed-in account email to the model's context at session start for people logged in with a Claude account. explainx.ai says users on an API key, Amazon Bedrock or Google Vertex reportedly don't get that line. That's from user reports, not an Anthropic statement.
• Earlier incidents. explainx.ai lists October reports of the email being sent to Liquipedia (issue #101659, version 2.1.285) and to Wikipedia across four search requests (issue #102577, version 2.1.300). It also cites a site operator who found no instances in about 10 million log lines — so this appears rare.
• The fix, as reported. Both AI TL;DR and StartupHub.ai say a reply on the new issue points to a built-in plugin, cc-plugin-privacy, in version 2.1.317 and later, which blocks the email substitution. It is on by default and can be turned off in /plugins. AI TL;DR also says 2.1.317 added a check that asks before a web or shell tool call sends the account email over the network.
• The open question. The reporter was on 2.1.318 — newer than the reported fix — and another 2.1.318 user said he couldn't see the plugin in /plugins, per StartupHub.ai. AI TL;DR notes the issue was still open and there was no separate official Anthropic statement. Commenters argue a plugin is a stopgap while the email still sits in the model's context by default.

We could not load the GitHub issue itself; details above are as reported by the named outlets.

What to do

1. Update Claude Code to the latest release, then open /plugins and confirm cc-plugin-privacy is listed and enabled. If it isn't there, treat yourself as unprotected.
2. Check whether the model knows your email. explainx.ai suggests running claude -p "What is my email address?". If it answers with your address, assume it can use it.
3. Add a guard hook. A PreToolUse hook in ~/.claude/settings.json matching Bash|WebFetch can block any command containing your email (and your git email or name). explainx.ai publishes an example script; test it on a harmless request first.
4. Use a no-reply git email (git config --global user.email with your GitHub noreply address) so the address the agent can see in repos isn't your real one.
5. Scrub context files. Remove personal emails, phone numbers and addresses from CLAUDE.md and memory notes the agent loads.
6. Teams: if you route agent traffic through a proxy, log outbound headers and search them for your staff's domains.

Who should care

Anyone running Claude Code signed in with a personal Claude account, especially with web search or curl-heavy research workflows. The broader lesson applies to every coding agent: whatever is in the context window — emails, names, tokens — can end up in a request the model writes. Watch issue #107757 for an official response and for whether the email is removed from default context altogether, which is what the reporter asked for.