CLAUDE CODE · TECH-202611-qj6zo6 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Claude Code gives the model the email address of the signed-in account. When the model writes its own web requests (curl -A, wget -U, scripts, often from subagents), it sometimes puts that address in the User-Agent header, sending it to whatever site it contacts. Users report a sharp rise in spam and scam email afterwards. Reported 5 Nov 2026 in anthropics/claude-code issue #107757 (version 2.1.318, macOS); earlier reports exist (#101659, #81138 from July). Anthropic acknowledged it: a built-in mod cc-plugin-privacy in 2.1.317 and later blocks some cases, and a release that removes the email from the model context is expected early in the week of 9 Nov 2026. The mod only checks Bash, PowerShell and Monitor calls that contain both the address and a User-Agent marker. WebFetch, WebSearch, MCP tools, other headers, URLs, request bodies, values read at run time (such as git config user.email) and scripts written to disk are not checked. Users on 2.1.317 and 2.1.318 report the mod loaded but not firing. The npm stable channel (2.1.311 on 6 Nov) has no mod. How many users were affected is unknown, and so is whether API-key sessions are affected.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Who cares privacy, technique
Run claude --version and npm view @anthropic-ai/claude-code dist-tags. Below 2.1.317 (including stable 2.1.311) has no protection. In Claude Code open /plugins and confirm cc-plugin-privacy is installed and enabled (some users on 2.1.318 do not see it). Search session logs in ~/.claude/projects/**/*.jsonl for tool_use calls that contain your account email (from oauthAccount.emailAddress in ~/.claude.json) together with User-Agent, user_agent, --user-agent, UA=, curl -A or wget -U. A hit means the model wrote such a request; read the call to see which host got it. A sudden rise in spam to the address used for Claude Code is a sign it leaked.
2.1.317 or later now, and move to the release that removes the email from the model context when it shipsPosts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.