# Claude Code put users' account email in web request headers — how to check yours and stop it

> A new GitHub report says Claude Code inserted a user's login email into the User-Agent header of web requests to third-party sites. A privacy plugin is reported to block it in recent builds, but the reporter was already on a newer version — here's how to check your setup.

Published Nov 6, 2026 by TechMeasured Staff · Security · Canonical: https://techmeasured.com/security/claude-code-email-user-agent-header-leak-cc-plugin-privacy-what-to-do

A Claude Code user reported on November 5 that Anthropic's coding agent **sent his account email address to third-party websites in the User-Agent header** while it was searching the web. The report, GitHub issue #107757 on the anthropics/claude-code repo, hit the top of Hacker News with more than 600 points. The reporter, on Claude Code 2.1.318 on macOS, says he now gets dozens of scam emails a day, according to AI TL;DR's summary of the issue.

Why it matters: this isn't a remote attack — it's an agent being "helpful." Some sites, Wikipedia among them, ask scripted clients to identify themselves with a contact email in the User-Agent. If the model has your email in its context, it can decide to put it there when it builds a `curl` command. Any site you research, and anything in between that logs headers, then has your address.

## What's been reported

- **Where the email comes from.** Reports going back to July (issue #81138, per explainx.ai) say Claude Code adds the signed-in account email to the model's context at session start for people logged in with a Claude account. explainx.ai says users on an API key, Amazon Bedrock or Google Vertex reportedly don't get that line. That's from user reports, not an Anthropic statement.
- **Earlier incidents.** explainx.ai lists October reports of the email being sent to Liquipedia (issue #101659, version 2.1.285) and to Wikipedia across four search requests (issue #102577, version 2.1.300). It also cites a site operator who found no instances in about 10 million log lines — so this appears rare.
- **The fix, as reported.** Both AI TL;DR and StartupHub.ai say a reply on the new issue points to a built-in plugin, **cc-plugin-privacy**, in version **2.1.317 and later**, which blocks the email substitution. It is on by default and can be turned off in `/plugins`. AI TL;DR also says 2.1.317 added a check that asks before a web or shell tool call sends the account email over the network.
- **The open question.** The reporter was on 2.1.318 — newer than the reported fix — and another 2.1.318 user said he couldn't see the plugin in `/plugins`, per StartupHub.ai. AI TL;DR notes the issue was still open and there was no separate official Anthropic statement. Commenters argue a plugin is a stopgap while the email still sits in the model's context by default.

We could not load the GitHub issue itself; details above are as reported by the named outlets.

## What to do

1. **Update Claude Code** to the latest release, then open `/plugins` and confirm **cc-plugin-privacy** is listed and enabled. If it isn't there, treat yourself as unprotected.
2. **Check whether the model knows your email.** explainx.ai suggests running `claude -p "What is my email address?"`. If it answers with your address, assume it can use it.
3. **Add a guard hook.** A `PreToolUse` hook in `~/.claude/settings.json` matching `Bash|WebFetch` can block any command containing your email (and your git email or name). explainx.ai publishes an example script; test it on a harmless request first.
4. **Use a no-reply git email** (`git config --global user.email` with your GitHub noreply address) so the address the agent can see in repos isn't your real one.
5. **Scrub context files.** Remove personal emails, phone numbers and addresses from `CLAUDE.md` and memory notes the agent loads.
6. **Teams:** if you route agent traffic through a proxy, log outbound headers and search them for your staff's domains.

## Who should care

Anyone running Claude Code signed in with a personal Claude account, especially with web search or `curl`-heavy research workflows. The broader lesson applies to every coding agent: whatever is in the context window — emails, names, tokens — can end up in a request the model writes. Watch issue #107757 for an official response and for whether the email is removed from default context altogether, which is what the reporter asked for.


## Sources

1. [AI TL;DR — Claude Code put a user's email in User-Agent (issue #107757)](https://ai-tldr.dev/releases/claude-code-email-in-user-agent-report/)
2. [StartupHub.ai — Claude Code sent your email in User-Agent](https://www.startuphub.ai/ai-news/artificial-intelligence/2026/claude-code-sent-your-email-in-user-agent)
3. [explainx.ai — Claude Code leaks your email in headers: how to stop it](https://explainx.ai/blog/claude-code-leaks-your-email-user-agent-header-how-to-stop-it-2026)