Recent reports have highlighted a significant privacy issue concerning Anthropic’s AI-powered coding tool, Claude Code. Users have raised alarms about their email addresses being leaked to third-party websites via HTTP User-Agent headers during web searches, sparking widespread concern over data privacy and security in AI applications.
Email Leaks Through User-Agent Headers
A GitHub user named Taylor Edwards brought this issue to light on November 5, 2026, in a report indicating an influx of scam emails. Edwards, who used Claude Code version 2.1.318 on macOS within tmux, demanded a complete removal of the behavior, rather than just an adjustable setting.
The report lacked concrete evidence such as raw HTTP requests or sample headers, leaving room for skepticism. Despite similar reports from other users, it remains unclear if the email leak directly led to the scam emails or affected all users of Claude Code.
Potential Privacy Breach in AI Tools
User-Agent headers typically indicate the software making a web request. With emails included in these headers, a privacy breach can occur when the information reaches a destination website. This incident points to a possible flaw in routine web access, rather than a database breach at Anthropic.
The discussion on GitHub suggested that commands written by the model itself might cause the issue. A quoted explanation revealed that Claude Code might use an email from its context as a contact address in a curl request, diverging from unauthorized traffic routing practices.
Efforts to Mitigate the Issue
An update from a Claude Code contributor mentioned that versions 2.1.317 and later contain a module named cc-plugin-privacy, intended to prevent such leaks. This module is reportedly enabled by default but can be deactivated via /plugins. However, Edwards was already using the updated version when the leak occurred.
Questions have arisen regarding the effectiveness of this protection. Some users reported difficulties locating the module, while others noted that harmless tests involving their account emails and User-Agent texts proceeded unblocked, casting doubt on the module’s robustness.
In response, a Claude Code employee stated that future releases would remove account emails from the model context, acknowledging current protection gaps. The issue remains unresolved, emphasizing the need for thorough reviews of agent-written network commands and privacy controls before enabling web access.
This serves as a reminder that configured safeguards should not be assumed foolproof in preventing sensitive data exposure. Organizations must integrate robust alert systems and threat intelligence to swiftly address such incidents.
