{"id":"TECH-202611-qj6zo6","kind":"technique","aliases":[],"related":[],"title":"Claude Code sends the signed-in user's email address to third-party websites in the User-Agent of requests it writes itself (Anthropic confirms, fix not shipped yet)","description":null,"summary":"Claude Code gives the model the email address of the signed-in account. When the model writes its own web requests (curl -A, wget -U, scripts, often from subagents), it sometimes puts that address in the User-Agent header, sending it to whatever site it contacts. Users report a sharp rise in spam and scam email afterwards. Reported 5 Nov 2026 in anthropics/claude-code issue #107757 (version 2.1.318, macOS); earlier reports exist (#101659, #81138 from July). Anthropic acknowledged it: a built-in mod cc-plugin-privacy in 2.1.317 and later blocks some cases, and a release that removes the email from the model context is expected early in the week of 9 Nov 2026. The mod only checks Bash, PowerShell and Monitor calls that contain both the address and a User-Agent marker. WebFetch, WebSearch, MCP tools, other headers, URLs, request bodies, values read at run time (such as git config user.email) and scripts written to disk are not checked. Users on 2.1.317 and 2.1.318 report the mod loaded but not firing. The npm stable channel (2.1.311 on 6 Nov) has no mod. How many users were affected is unknown, and so is whether API-key sessions are affected.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Claude Code","fixed":[],"package":"@anthropic-ai/claude-code","affected":"all versions signed in with an account; 2.1.317 to 2.1.319 only partly mitigated by cc-plugin-privacy","ecosystem":"npm"}],"ecosystems":[],"tags":["early-warning","privacy","technique"],"not_affected_if":[],"how_to_check":"Run claude --version and npm view @anthropic-ai/claude-code dist-tags. Below 2.1.317 (including stable 2.1.311) has no protection. In Claude Code open /plugins and confirm cc-plugin-privacy is installed and enabled (some users on 2.1.318 do not see it). Search session logs in ~/.claude/projects/**/*.jsonl for tool_use calls that contain your account email (from oauthAccount.emailAddress in ~/.claude.json) together with User-Agent, user_agent, --user-agent, UA=, curl -A or wget -U. A hit means the model wrote such a request; read the call to see which host got it. A sudden rise in spam to the address used for Claude Code is a sign it leaked.","fix":"Update to Claude Code 2.1.317 or later now, and move to the release that removes the email from the model context when it ships. Until then, add a PreToolUse hook (matcher Bash|PowerShell|Monitor|Write|Edit|WebFetch) that blocks any tool call containing your account or git email, or block outbound requests carrying it at the network layer. Set git user.email to your Git host noreply address so the model cannot read your real address from git config. Teams: treat developer email addresses as exposed and warn staff about follow-on phishing.","status":"open","published_at":null,"first_seen_at":"2026-11-06T16:03:15+00:00","triaged_at":"2026-11-06T16:03:15+00:00","updated_at":"2026-11-06T16:03:32+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':34A '101659':116B '107757':109B '2.1.311':223B '2.1.317':133B,209B '2.1.318':111B,211B '2026':105B,159B '5':103B '6':225B '81138':117B '9':157B 'account':56B 'acknowledg':121B 'address':11A,50B,77B,173B 'affect':234B,246B 'afterward':101B 'agent':21A,82B,178B 'anthrop':27A,120B 'anthropics/claude-code':107B 'api':242B 'api-key':241B 'bash':164B 'block':136B 'bodi':188B 'built':125B 'built-in':124B 'call':168B 'case':138B 'cc':129B 'cc-plugin-privaci':128B 'channel':222B 'check':163B,206B 'claud':1A,43B 'claude':36A 'code':2A,37A,44B 'config':197B 'confirm':28A 'contact':90B 'contain':170B 'context':149B 'curl':65B 'disk':203B 'earli':39B,152B 'earlier':113B 'early-warn':38B 'email':10A,49B,100B,145B 'exist':115B 'expect':151B 'fire':218B 'fix':29A 'git':196B 'give':45B 'header':83B,185B 'issu':108B 'juli':119B 'key':243B 'later':135B 'load':215B 'maco':112B 'mani':231B 'marker':179B 'mcp':182B 'mod':127B,161B,214B,229B 'model':47B,59B,148B 'monitor':167B 'nov':104B,158B,226B 'npm':220B 'often':70B 'parti':15A 'plugin':130B 'powershel':165B 'privaci':41B,131B 'put':75B 'qj6zo6':35A 'read':190B 'releas':141B 'remov':143B 'report':92B,102B,114B,212B 'request':23A,64B,187B 'rise':95B 'run':192B 'scam':99B 'script':69B,200B 'send':3A,84B 'session':244B 'sharp':94B 'ship':31A 'sign':6A,54B 'signed-in':5A,53B 'site':88B 'sometim':74B 'spam':97B 'stabl':221B 'subag':72B 'tech':33A 'techniqu':42B 'third':14A 'third-parti':13A 'time':193B 'tool':183B 'u':68B 'unknown':236B 'url':186B 'user':8A,20A,81B,91B,177B,207B,232B 'user-ag':19A,80B,176B 'user.email':198B 'valu':189B 'version':110B 'warn':40B 'web':63B 'webfetch':180B 'websearch':181B 'websit':16A 'week':155B 'wget':67B 'whatev':87B 'whether':240B 'write':25A,60B 'written':201B 'yet':32A","nicknames":["cc-plugin-privacy"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["ccpluginprivacy","claudecode"],"ptokens":["claude","code"],"labels":["aitooling","earlywarning","medium","privacy","technique"],"campaign_type":"other","search_a":"'-202611':34A 'address':11A 'agent':21A 'anthrop':27A 'claud':1A 'claude':36A 'code':2A,37A 'confirm':28A 'email':10A 'fix':29A 'parti':15A 'qj6zo6':35A 'request':23A 'send':3A 'ship':31A 'sign':6A 'signed-in':5A 'tech':33A 'third':14A 'third-parti':13A 'user':8A,20A 'user-ag':19A 'websit':16A 'write':25A 'yet':32A","search_b":"'101659':116B '107757':109B '2.1.311':223B '2.1.317':133B,209B '2.1.318':111B,211B '2026':105B,159B '5':103B '6':225B '81138':117B '9':157B 'account':56B 'acknowledg':121B 'address':50B,77B,173B 'affect':234B,246B 'afterward':101B 'agent':82B,178B 'anthrop':120B 'anthropics/claude-code':107B 'api':242B 'api-key':241B 'bash':164B 'block':136B 'bodi':188B 'built':125B 'built-in':124B 'call':168B 'case':138B 'cc':129B 'cc-plugin-privaci':128B 'channel':222B 'check':163B,206B 'claud':43B 'code':44B 'config':197B 'contact':90B 'contain':170B 'context':149B 'curl':65B 'disk':203B 'earli':39B,152B 'earlier':113B 'early-warn':38B 'email':49B,100B,145B 'exist':115B 'expect':151B 'fire':218B 'git':196B 'give':45B 'header':83B,185B 'issu':108B 'juli':119B 'key':243B 'later':135B 'load':215B 'maco':112B 'mani':231B 'marker':179B 'mcp':182B 'mod':127B,161B,214B,229B 'model':47B,59B,148B 'monitor':167B 'nov':104B,158B,226B 'npm':220B 'often':70B 'plugin':130B 'powershel':165B 'privaci':41B,131B 'put':75B 'read':190B 'releas':141B 'remov':143B 'report':92B,102B,114B,212B 'request':64B,187B 'rise':95B 'run':192B 'scam':99B 'script':69B,200B 'send':84B 'session':244B 'sharp':94B 'sign':54B 'signed-in':53B 'site':88B 'sometim':74B 'spam':97B 'stabl':221B 'subag':72B 'techniqu':42B 'time':193B 'tool':183B 'u':68B 'unknown':236B 'url':186B 'user':81B,91B,177B,207B,232B 'user-ag':80B,176B 'user.email':198B 'valu':189B 'version':110B 'warn':40B 'web':63B 'webfetch':180B 'websearch':181B 'week':155B 'wget':67B 'whatev':87B 'whether':240B 'write':60B 'written':201B","search_c":"","first_public_at":"2026-11-05T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-qj6zo6","url":"https://github.com/anthropics/claude-code/issues/107757","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-06T16:03:15+00:00","fetched_at":"2026-11-06T16:03:15+00:00","note":null,"cites":["https://github.com/anthropics/claude-code/issues/107757","https://theainewsreport.com/2026-11-06-claude-code-email-user-agent-leak-privacy-mod-explained.html"]}],"documents":[{"id":87631,"url":"https://news.ycombinator.com/item?id=50394000","title":"How to block the Claude Code email leak","kind":"post","source":"hackernews","publisher":null,"text":"How to block the Claude Code email leak\nhttps://theainewsreport.com/2026-11-06-claude-code-email-user-agent-leak-privacy-mod-explained.html\n\n1 points, 0 comments on Hacker News","published_at":"2026-11-06T15:58:11+00:00","relation":"describes","confidence":null,"note":null},{"id":87634,"url":"https://github.com/anthropics/claude-code/issues/107757","title":"Bug Report: Privacy violation in User-Agent header (anthropics/claude-code #107757)","kind":"issue","source":"analyst","publisher":null,"text":"Claude Code 2.1.318 on macOS put the user's email address in the User-Agent header of web requests to third parties without permission; reporter now receives daily scam email. Anthropic contributor poteat: built-in mod cc-plugin-privacy blocks this in v2.1.317 and later, enabled by default, can be turned off via /plugins; mod source made available. A user on 2.1.318 reports not seeing cc-plugin-privacy in /plugins. Related earlier issue #101659 (subagent sent user email from session context in User-Agent) and #81138 (from July).","published_at":"2026-11-05T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":87639,"url":"https://theainewsreport.com/2026-11-06-claude-code-email-user-agent-leak-privacy-mod-explained.html","title":"Claude Code email leak in User-Agent headers explained","kind":"blog","source":"analyst","publisher":null,"text":"Claude Code put the signed-in account email in the model's context; model-written curl/scripts sometimes used it as contact in User-Agent (one user: 53 calls across 8 sessions, mostly subagents with curl -A). Anthropic (Lydia Hallie, HN) says the next release, expected early next week, removes the email from context. Stopgap: built-in mod cc-plugin-privacy in 2.1.317+, checks only Bash, PowerShell, Monitor calls that contain the address AND a User-Agent marker (User-Agent, user_agent, --user-agent, UA=, curl -A, wget -U, -UserAgent). Not checked: WebFetch, WebSearch, MCP tools, other headers/URL/body, run-time values like , scripts written to disk. npm dist-tags on 6 Nov: stable 2.1.311 (no mod), latest 2.1.318, next 2.1.319. Users report mod loaded but not firing on 2.1.317/2.1.318. Check: scan ~/.claude/projects/**/*.jsonl for tool_use calls holding your email plus user-agent or -A. Mitigation: PreToolUse hook blocking calls containing your email; set git user.email to noreply address.","published_at":"2026-11-06T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}