---
id: "TECH-202611-qj6zo6"
page: "https://infrastack.ai/live/TECH-202611-qj6zo6"
kind: "technique"
aliases: []
title: "Claude Code sends the signed-in user's email address to third-party websites in the User-Agent of requests it writes itself (Anthropic confirms, fix not shipped yet)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Claude Code", "fixed": [], "package": "@anthropic-ai/claude-code", "affected": "all versions signed in with an account; 2.1.317 to 2.1.319 only partly mitigated by cc-plugin-privacy", "ecosystem": "npm"}]
ecosystems: []
tags: ["early-warning", "privacy", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-06T16:03:15+00:00"
updated_at: "2026-11-06T16:03:32+00:00"
sources: [{"source": "analyst", "url": "https://github.com/anthropics/claude-code/issues/107757", "first_seen_at": "2026-11-06T16:03:15+00:00", "cites": ["https://github.com/anthropics/claude-code/issues/107757", "https://theainewsreport.com/2026-11-06-claude-code-email-user-agent-leak-privacy-mod-explained.html"]}]
exploit_sources: []
---

# cc-plugin-privacy: Claude Code sends the signed-in user's email address to third-party websites in the User-Agent of requests it writes itself (Anthropic confirms, fix not shipped yet)

Link for people: https://infrastack.ai/live/TECH-202611-qj6zo6 (this .md is for agents)

Claude Code gives the model the email address of the signed-in account. When the model writes its own web requests (curl -A, wget -U, scripts, often from subagents), it sometimes puts that address in the User-Agent header, sending it to whatever site it contacts. Users report a sharp rise in spam and scam email afterwards. Reported 5 Nov 2026 in anthropics/claude-code issue #107757 (version 2.1.318, macOS); earlier reports exist (#101659, #81138 from July). Anthropic acknowledged it: a built-in mod cc-plugin-privacy in 2.1.317 and later blocks some cases, and a release that removes the email from the model context is expected early in the week of 9 Nov 2026. The mod only checks Bash, PowerShell and Monitor calls that contain both the address and a User-Agent marker. WebFetch, WebSearch, MCP tools, other headers, URLs, request bodies, values read at run time (such as git config user.email) and scripts written to disk are not checked. Users on 2.1.317 and 2.1.318 report the mod loaded but not firing. The npm stable channel (2.1.311 on 6 Nov) has no mod. How many users were affected is unknown, and so is whether API-key sessions are affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:Claude Code affected all versions signed in with an account; 2.1.317 to 2.1.319 only partly mitigated by cc-plugin-privacy fixed no fixed version listed

## How to check

Run claude --version and npm view @anthropic-ai/claude-code dist-tags. Below 2.1.317 (including stable 2.1.311) has no protection. In Claude Code open /plugins and confirm cc-plugin-privacy is installed and enabled (some users on 2.1.318 do not see it). Search session logs in ~/.claude/projects/**/*.jsonl for tool_use calls that contain your account email (from oauthAccount.emailAddress in ~/.claude.json) together with User-Agent, user_agent, --user-agent, UA=, curl -A or wget -U. A hit means the model wrote such a request; read the call to see which host got it. A sudden rise in spam to the address used for Claude Code is a sign it leaked.

## Fix

Update to Claude Code 2.1.317 or later now, and move to the release that removes the email from the model context when it ships. Until then, add a PreToolUse hook (matcher Bash|PowerShell|Monitor|Write|Edit|WebFetch) that blocks any tool call containing your account or git email, or block outbound requests carrying it at the network layer. Set git user.email to your Git host noreply address so the model cannot read your real address from git config. Teams: treat developer email addresses as exposed and warn staff about follow-on phishing.

## Timeline

- 2026-11-06T16:03:15+00:00 analyst https://github.com/anthropics/claude-code/issues/107757

## Documents

- [describes] How to block the Claude Code email leak https://news.ycombinator.com/item?id=50394000
- [describes] Bug Report: Privacy violation in User-Agent header (anthropics/claude-code #107757) https://github.com/anthropics/claude-code/issues/107757
- [describes] Claude Code email leak in User-Agent headers explained https://theainewsreport.com/2026-11-06-claude-code-email-user-agent-leak-privacy-mod-explained.html

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_