Yes: in some sessions, Claude Code has put your Anthropic account email in the User-Agent header of requests to third-party websites, which can read and store it. A macOS user reported this on November 5, 2026 in GitHub issue #107757, and an Anthropic collaborator responded that an integrated mod, cc-plugin-privacy, blocks this behavior from version 2.1.317 onward. At the time of publishing this note, the issue remains open and an independent test indicates the mod does not prevent all cases.
Status as of November 6, 2026: the issue remains open; the
stableupdate channel is still on version 2.1.311, which does not include the mod, andlatestis on 2.1.318. We will update this note when Anthropic publishes the announced fix.
What exactly did Claude Code do with your email?
According to the report, Claude Code included the user’s email in the User-Agent header of requests made when searching the web, without asking permission. The issue author attributes the dozens of spam emails they receive daily to this.
There are three things the report does not include that matter for measuring the scope:
- the exact text of the
User-Agent; - which tool made the request (only mentions “web searches”);
- steps to reproduce it.
The issue is labeled platform:macos. At the time of publishing, no one has confirmed whether Windows and Linux are also affected.
A key detail: the author was using version 2.1.318, which already includes the mod that Anthropic presents as the solution. Keep this in mind when reading the following sections.
What is User-Agent and why does it matter if it contains your email?
The User-Agent is the HTTP header with which a client identifies itself to the server: browser, version, operating system. Servers store it routinely, so an email traveling there ends up in access logs, in analytics tools, and in any other system that website uses. It doesn’t require anyone to steal it: it’s enough that someone reads their own records.
Some tools deliberately put a contact email in the User-Agent so that the owner of a website can alert them if a bot causes problems. The difference here is that the email is yours and no one asked you.
Why does Claude Code know your email?
Because Claude Code puts it in the model context. Another, older issue, #81138, documents a block present in each session that tells the model the address of the connected account, taken from oauthAccount.emailAddress in ~/.claude.json. That report was made against version 2.1.220, indicates there is no setting to disable it, and describes the model using the address in its responses and in git commits.
Once the model has the address, it can write it in any text it generates, including a header inside a curl command that it drafts itself. A comment in #107757 reproduces a Hacker News post, attributed to someone claiming to work on Claude Code, explaining that the email was added so Claude would stop making up names in fields like @author and that the next version would remove it from the context. We could not verify that post on Hacker News and Anthropic has not published it anywhere else, so treat it as unconfirmed until it appears in a changelog.
Several commenters on #81138 also indicate that the block only appears when you log in with a subscription (OAuth), and not when Claude Code authenticates with an API key, Amazon Bedrock, or Google Vertex. This is a community finding, not documented behavior.
Which version of Claude Code includes the fix?
According to the Anthropic collaborator on the issue, version 2.1.317 and later, through an integrated mod called cc-plugin-privacy that comes enabled by default. Version 2.1.317 was published to npm on November 2, 2026.
Which version you have depends on your update channel, and that’s where the catch is: as of November 6, 2026, the stable channel was still on 2.1.311, so if you’re on stable you don’t have the mod. You’re on stable if any of these conditions apply:
- you set
"autoUpdatesChannel": "stable"insettings.json, or selected it in/config→ Auto-update channel; - you installed via Homebrew using the
claude-codecask (theclaude-code@latestcask follows the latest channel); - you installed from the
stablerepository of apt, dnf, or apk.
How do you know which version of Claude Code you have?
- Terminal: run
claude --version. - Desktop app: in a local session on the Code tab, type
/statusand look at the Claude Code row.
How do you update Claude Code?
On a native installation, run claude update; it follows the latest channel unless you configured stable. On Homebrew, the latest channel is the claude-code@latest cask. With npm, run npm install -g @anthropic-ai/claude-code@latest.
How do you verify that cc-plugin-privacy is active in Claude Code’s plugins?
Run /plugin in the Claude Code prompt, open the Installed tab, and search in the Built-in section. Integrated mods cannot be updated or uninstalled, only disabled from that tab. (The collaborator’s comment says /plugins; the documented command is /plugin.)
Two details from the official documentation worth knowing:
- At the time of publishing,
cc-plugin-privacydoes not appear in the table of integrated mods in the documentation. Its code is also not yet in the publicmodsdirectory of the Claude Code repository; the collaborator said they would try to publish it there. --safe-mode,--bare, and"disableAllHooks": truedo not stop integrated mods. If you turned off your own mods, this one still works, which is exactly what you want here.
Does the privacy mod actually block the leak?
Not entirely, according to both Anthropic’s own description and at least one external test.
- What it covers. The collaborator wrote that the mod exists to block this behavior deterministically. The post reproduced from Hacker News describes something narrower: the mod asks you before Claude executes a web call or
curl-type command containing your email, and acknowledges it does not prevent all cases, for example a script that Claude writes and runs on its own. - What one test found. On November 6, a commenter on the issue ran a Bash command containing
User-Agent:and their account email, on version 2.1.317 (desktop app) and 2.1.318 (claude -p). Both executed without being rejected, even though/pluginshowed the mod installed and enabled. They asked whether the distributed version differs from the published code. At the time of publishing, no maintainer has responded.
In summary: updating to 2.1.317 or later is necessary, but with the available evidence it is not sufficient.
What else can you do while you wait for the fix?
- Leave
stablefor now, or make sure you’re on 2.1.317 or later: stable is the only channel that definitely doesn’t have the mod. - Read the approval notices. If the mod works as described, it asks you before a web or
curl-type call containing your email. That notice is the protection, so don’t approve it reflexively. - Review what Claude executes. According to the explanation reproduced from Hacker News, scripts that Claude writes and runs are not covered: review any script that makes network requests before letting it run.
- Follow both issues. #107757 for the leak in the
User-Agentand #81138 for the email in the context. The fix for the context is the one that eliminates the root cause.
There is already a third-party repository, AlexErrant/claude-code-no-email, that proposes a mod to remove the address. Its README is too brief to evaluate, so we don’t recommend it for now.
What is Claude Code?
Claude Code is Anthropic’s agentic programming tool: it runs in the terminal, in the Code tab of Claude’s desktop app, and in IDEs, reads your repository, edits files, and executes commands on your behalf. That last part is why this matters: an agent that drafts its own shell commands can put in them any data it knows about, including your email.
You? Which update channel do you use in Claude Code, and why did you choose it?
- Yes, I’m on 2.1.317 or later
- I’m on stable (2.1.311) and I’m going to switch
- I use API key, Bedrock, or Vertex, not a subscription
- I prefer another option (tell us which)
Comment below or, if this article reached you by email, reply directly to the email: your response is published here.