Claude Code Was Leaking Email in User-Agent: Anthropic Patched the Hole in 2.1.317

⚡ The 5-Second Rundown

• Claude Code was inserting the owner's email into the User-Agent header during web searches — without asking and without warning.
• Anthropic has enabled a built-in mod called cc-plugin-privacy: it strips this behavior starting with version 2.1.317 and is active by default.
• It can be disabled manually via /plugins; on version 2.1.318 under macOS the bug was still reproducible.

🔍 What Happened

On November 5, 2026, user taylor-edwards opened issue #107757 in the anthropics/claude-code repository. The gist: during a web search, Claude Code was sending his email address to third-party sites right in the User-Agent header. Nobody asked for permission. Environment from the report: macOS (darwin), tmux, version 2.1.318, feedback ID f81eb83d-9b95-4788-8773-d3fae8f0cec4. The issue already has 189 reactions 👍, and the Hacker News thread gathered 640 points and 220 comments — link to issue #107757.

What User-Agent is, in short: it's the string a client uses to identify itself to a server. Usually it contains the program name and version number. No website needs an email there — not for analytics, not for bot filtering. The report's author writes that he receives dozens of scam emails a day. He goes on to say he's moving his company to Pi with OpenRouter because he "doesn't trust Anthropic to keep his data private." In the same thread, maintainer poteat replied: the built-in mod cc-plugin-privacy deterministically blocks this behavior in v2.1.317 and later, is enabled by default, and can be turned off via /plugins. He promised to publish the mod's source code.

🧠 Our Take

What gets me here isn't the bug itself, but the fact that this was a setting, not an accident. The report's author states outright: opt-in or opt-out won't cut it — the string needs to be removed from the harness entirely. It looks like a typical story of "we did it to distinguish agent traffic from human traffic" — but the emails land in the user's inbox, not the developers'.

For agentic tools, request metadata is a leak channel just like logs and trackers. We believe that for those running Claude Code on a work account, this damages the reputation of their mail domain. One address in the UA — and it's already in someone else's databases, where no patch can dig it out.

Who wins? The alternatives. Any competitor can now sell "zero metadata" as a feature without even having to prove anything — just point to this issue. Who loses? Anthropic, whose fix shipped after a public scandal rather than before. Our assessment: one developer's protest is unlikely to turn into a mass migration, but a bad taste will remain.

⚠️ What We Don't Know

The main thing: from which version the email was being placed in the UA, and how many users left traces. The source of cc-plugin-privacy hasn't been published yet, so there's no way to verify the "deterministic" blocking. Plus, the report itself is one voice plus reactions; there's no independent audit and no official advisory either. Whether to take it on faith is up to you, but we'd advise checking your own traffic.

Prediction: within a quarter, Anthropic will publish the cc-plugin-privacy sources and add a changelog line explaining where the email in User-Agent came from in the first place.

Disclaimer: officially confirmed only in the issue thread; no independent audit exists.

Source: GitHub / anthropics/claude-code