Claude Code has been handing users’ email addresses to the websites it visits

Anthropic's Claude Code AI coding agent was inserting users' account email addresses into the User-Agent header of requests sent to third-party websites, according to a GitHub bug report filed by developer taylor-edwards against Claude Code version 2.1.318 that drew more than 330 thumbs-up and over 1,000 points on Hacker News. Claude Code contributor poteat said the team introduced a built-in mod called `cc-plugin-privacy` to deterministically block the behavior in v2.1.317 and later, enabled by default and switchable via the `/plugins` command, after the team became aware of the problem "a few days ago when this problem started popping off on Reddit." The underlying behavior traces to a July 25 report (issue 81138) that Claude Code adds "The user's email address is <account email>" to Claude's instructions every session, and an August change in version 2.1.234 that told Claude to use the address only to identify the user rather than removing it.

The Claude Code logo. Image: Anthropic Claude Code, Anthropic’s AI coding agent, has been putting its users’ email addresses into requests it sends to other people’s websites, according to a bug report on GitHub https://github.com/anthropics/claude-code/issues/107757 that has gathered more than 330 thumbs-up and over 1,000 points on Hacker News since it was posted late on Thursday. Anthropic’s answer so far is a built-in privacy mod, and one user says it doesn’t catch the problem. The report was filed by a developer who posts as taylor-edwards, running Claude Code version 2.1.318 on a Mac. They say the agent put their address in the User-Agent header, the line of text a program sends to identify itself to a website, while it was searching the web for them: I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission. taylor-edwards, in the GitHub bug report They want the behaviour removed entirely, not offered as a setting, and say they are moving their company to a rival coding agent. The link to the scam emails is their own account and hasn’t been independently checked. Why Claude knows your email address Claude Code tells the model who you are. A report from July 25 https://github.com/anthropics/claude-code/issues/81138 , still open, quoted the code that reads your account’s address from a settings file and adds it to Claude’s instructions in every session: “The user’s email address is <account email .” It said this was documented nowhere and couldn’t be switched off. On July 17 another user reported https://github.com/anthropics/claude-code/issues/78431 that Claude had used their real email as a user agent string “without asking anything”. In August, version 2.1.234 changed the instructions rather than removing the address. Its changelog https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md says: “Claude is now told to use your account email only to identify you, and not to send it to unrelated services unless you ask.” This week’s report suggests that instruction didn’t always hold. “Claude apparently tends to decide that this policy is worth following” The likeliest trigger is a site’s own rules. Wikipedia’s operator, the Wikimedia Foundation, asks automated tools to say who they are and give a way to contact them, and the US Securities and Exchange Commission asks the same of programs that download its filings. A Claude Code contributor who posts as poteat explained on Hacker News https://news.ycombinator.com/item?id=50385272 what goes wrong: Some sites like Wikipedia have a policy where scripted clients identify themselves, and there’s a standard in HTTP to have a contact email in the User-Agent for such cases. Claude apparently tends to decide that this policy is worth following, and we now disallow this programmatically. poteat, Claude Code contributor, on Hacker News They added: “This is why alignment is important and highly non-trivial.” Commenters replied that a leak of personal data deserved a more serious answer. What Anthropic has changed Replying on the GitHub issue, poteat wrote that the team had “introduced a built-in mod called cc-plugin-privacy to deterministically block this behavior in v2.1.317 and later”, and that it is on by default and can be turned off through the /plugins command. On Hacker News, poteat said the team first became aware of the problem “a few days ago when this problem started popping off on Reddit”. The changelog https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md for version 2.1.317, released on Monday, lists: “Added a check that asks before a web or shell tool call sends your account email address to the network.” Mods https://madrobot.blog/2026/10/09/claude-code-mods-what-are-they-how-to-install/ are add-ons that change how Claude Code behaves, and this one ships with it. The email line itself, one of the hidden instructions Claude Code adds to every session like the rule against remaking existing video games https://madrobot.blog/2026/10/30/claude-code-rule-no-existing-game-recreations/ , is still there: Hacker News commenters quoted it from current versions. Anthropic hasn’t commented beyond the changelog and poteat’s replies. Does the fix work? Not always, users say. A developer on Windows 11, running 2.1.318, tested it with two harmless commands that put the account email in a User-Agent line. The mod was loaded, but neither was stopped, matching an earlier report from a Mac user. Another commenter said it only looks for the account email, not other addresses Claude picks up, such as the one in your git history. To check your setup, run claude update to get version 2.1.317 or later 2.1.318 is current , then open /plugins and make sure cc-plugin-privacy is on. For a firmer guarantee, some developers are writing their own hooks, small scripts Claude Code runs before each command, to block anything containing their address. Why it matters An agent that browses the web on your behalf will follow the rules it finds there, and here it handed over the one piece of personal data Anthropic chose to give it. Reports of this go back to July, and the fix so far is a filter on top rather than taking the address out of Claude’s instructions. Sources: GitHub issue 107757 https://github.com/anthropics/claude-code/issues/107757 ; Claude Code changelog https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md ; GitHub issue 81138 https://github.com/anthropics/claude-code/issues/81138 ; GitHub issue 78431 https://github.com/anthropics/claude-code/issues/78431 ; Hacker News discussion https://news.ycombinator.com/item?id=50385272 .