Claude Code bug report: user email addresses sent to websites in User-Agent header

A GitHub bug report says Claude Code put a user's email in the User-Agent sent to third-party sites; a reply points to a default-on privacy mod.

What happened

A bug report on the anthropics/claude-code GitHub repository, titled "Claude Code sends your email address to websites," says Claude Code divulged the reporter's email address to arbitrary third parties in the User-Agent request header while conducting web searches, without permission. The reporter writes that they receive dozens of scam emails per day as a result, and argues the behavior should be removed from the harness entirely rather than offered as an opt-in or opt-out setting, saying it does nothing for services that dislike agentic traffic, does not preserve anonymity on the web, and is "a goldmine for scammers." The reporter also says they are migrating their company to Pi with OpenRouter. The environment info lists platform darwin, terminal tmux, and version 2.1.318. The issue was labeled "bug" and "platform:macos" on Nov 5, 2026.

A reply in the thread states that a built-in mod called cc-plugin-privacy was introduced to "deterministically block this behavior" in v2.1.317 and later, asks people to report any gap in the checks that mod introduces, and says the mod is enabled by default and can be turned off via /plugins. The same reply says the author will try to make the built-in mod's source available as is done for other built-in mods.

Another commenter says they scanned every tool call in ~/.claude/projects/**/*.jsonl and found 53 calls that put their email into a User-Agent, spread across 8 sessions from 2026-08-09 to 2026-11-01, and that almost all came from workflow subagents writing their own curl -A "/1.0 ()" rather than from WebFetch. Other commenters raise questions about GDPR. A commit referencing the issue was added on Nov 6, 2026.

Why it matters

For teams running Claude Code agents, the report describes personally identifiable information leaving the machine as a side effect of ordinary web access, reaching whichever hosts the agent happened to contact. The thread gives a concrete way to check exposure locally: one commenter searched tool calls in ~/.claude/projects/**/*.jsonl for an email address appearing in a User-Agent, and counted the calls, sessions and date range involved.

That commenter's finding also points at where the behavior originated in their case: almost all of the calls came from workflow subagents writing their own curl commands with -A "/1.0 ()", not from WebFetch.

The reply in the thread gives operators two specific things to verify: that they are on v2.1.317 or later, where the built-in cc-plugin-privacy mod is said to block the behavior, and that the mod is still enabled, since it is on by default but can be switched off through /plugins. The same reply explicitly invites reports of gaps in its checks, so the fix as described is being treated as something users should test rather than assume.

Commenters in the thread also raise the question of GDPR exposure for third-party services that received user email addresses without knowing it, which is a compliance angle for teams whose agents browse on behalf of identifiable users.

What we don't know yet

The thread does not say who wrote the reply announcing cc-plugin-privacy, nor what exactly the mod's checks cover: it is unclear whether they catch subagent-authored curl commands as well as the harness's own fetch paths, and the reply says the mod's source is still to be made available. The reporter's environment lists version 2.1.318 while the mod is described as shipping in v2.1.317 and later, and the report does not state when the observed requests were made, so the relationship between the two is unresolved. No source here independently verifies the leak, the one commenter's count of 53 calls across 8 sessions, or the link between the exposure and the scam email volume described. What the commit referenced on Nov 6, 2026 changes is not stated, and nothing in the thread addresses how many users were affected, which hosts received the data, whether affected users will be notified, or how the GDPR questions raised by commenters will be answered.

Sources: github.com

How this Deep Take is made: it is written with AI assistance from the linked sources, then checked against them sentence by sentence, and every fact links to where it came from.