# Claude Code email leak claim: what the GitHub issue says

> A GitHub issue with 1,100+ Hacker News points says the tool put a personal email in its User-Agent header. Anthropic's contributor points to a privacy mod added in v2.1.317.

URL: https://claudegpt.si/news/claude-code-email-user-agent  
Published: 2026-11-06T10:51:14.421Z  
Author: ClaudeGPT Si Newsroom  
Section: AI Tools  
Topics: Anthropic, Claude Code, Privacy, AI agents  
Publisher: ClaudeGPT Si

## Key takeaways

- A GitHub issue filed November 5 says Claude Code 2.1.318 put a user's email address in the User-Agent header of web requests.
- An Anthropic contributor says a default-on privacy mod, cc-plugin-privacy, shipped in v2.1.317 to block this.
- The issue is open and the thread does not confirm whether the mod fixed the reporter's case.

A user reported on November 5 that Claude Code put their personal email address in the User-Agent header of its web requests, and the [GitHub issue](https://github.com/anthropics/claude-code/issues/107757) has passed 1,100 points on Hacker News. The issue is still open. An Anthropic contributor says a built-in privacy mod that blocks this already shipped.

## What the report says

The reporter, who runs Claude Code 2.1.318 on macOS, says the tool included their email address in the User-Agent header while doing web searches. A User-Agent header is the line a program sends to every website saying who it is. The reporter says they never agreed to this, that the address reached third-party sites, and that they now get dozens of scam emails a day. The issue shows no captured request, so the exact header is described, not demonstrated.

A second user says Claude Code sent their personal email, taken from their gitconfig, when it fetched pages from SEC EDGAR. The SEC asks automated clients to identify themselves with a contact address in this header, which may be why an agent would add one. That user also shared an open-source hook and reports leaks in 8 of 60 of their own test runs without it and none with it. Those numbers are theirs and unverified.

## What Anthropic has said

A contributor named poteat replied in the issue that v2.1.317 added a built-in mod, `cc-plugin-privacy`, that blocks this behavior. It is on by default and can be turned off in `/plugins`. The source is promised for the public mods directory, and users are asked to report cases it misses. The reporter's version is newer than 2.1.317, and the thread does not say whether the mod fixed their case.

## What to do now

- Run `claude --version` and update if you are below 2.1.317.
- Check that the privacy mod is still on in `/plugins`.
- Look at your gitconfig: if it holds a real address, that is the one an agent can find.

We don't know yet how many users were affected, when the behavior began, or which sites received the address. Watch the issue for Anthropic's answer on those points. For how Claude Code handles tools and permissions, see our [guide to removing MCP tools in Claude Code](https://claudegpt.si/news/claude-how-to-remove-tools-free-up-space).

## Sources

- [Claude Code sends your email address to websites (issue 107757)](https://github.com/anthropics/claude-code/issues/107757), GitHub
- [Hacker News discussion](https://news.ycombinator.com/item?id=50385272), Hacker News