Claude Code bug report says the agent leaked a user's email address in web-request User-Agent headers
The GitHub issue, with 183 reactions, says version 2.1.318 sent the signed-in email to third-party sites during web searches; an Anthropic contributor replied that a built-in privacy mod in v2.1.317 and later blocks this by default.
Why it matters
The reporter, who says they get dozens of scam emails a day, argues the email should never be placed in the User-Agent header and says they are moving their company to another harness. An Anthropic contributor replied that Claude Code v2.1.317 and later ship a built-in privacy mod that deterministically blocks the behaviour, enabled by default and switchable in /plugins, and said it will try to publish the mod's source. The claim that the email caused the scam mail is the reporter's and is unverified here. Watch for gaps found in the mod and whether Anthropic removes the header entirely.
Key facts
- Issue #107757 opened Nov. 5, 2026 and labelled area:security
- Reported on Claude Code 2.1.318, macOS
- 183 reactions and 27 comments when read
- Anthropic: built-in privacy mod in v2.1.317 and later blocks this; on by default; toggle in /plugins
- Anthropic says it will try to publish the mod's source
- Link between the leaked email and scam mail is the reporter's claim