Claude Code's email-in-User-Agent leak is a default-privacy failure

Would you hand your email address to every website your assistant happens to read for you? Nobody would say yes. Yet that is what a bug report says Claude Code did, and the details matter less than the design instinct behind it.

What happened, briefly

On November 5, a developer opened GitHub issue #107757 against Claude Code. The reporter says Claude Code revealed their email to arbitrary third parties in the User-Agent request header during web searches, and that they now get dozens of scam emails a day. According to AI Weekly Malaysia, the report was filed against v2.1.318 on macOS, and the reporter is moving their company to Pi with OpenRouter. The story spread quickly: clauding.de says the issue reached 687 points on Hacker News within hours.

On the fix, the documentation is thinner and partly contradictory. StartupHub.ai says Anthropic's answer is a toggle called cc-plugin-privacy in /plugins, enabled by default in v2.1.317. That version number is lower than the one in the bug report, so we can't say from what we have which builds are affected. We also haven't seen an official Anthropic statement. Treat the details as unsettled. The scam-email causation is also the reporter's claim, not something we can verify.

An identifier in a header is a decision, not an accident

User-Agent strings exist to tell a server what software is knocking. Putting a personal email in there turns a technical label into a tracking tag. However it got there, it looks to us like someone had to decide it belonged in outbound traffic.

Our view is that this is the failure. Not that a bug slipped through, because bugs happen. The failure is that identity-bearing data was in the default path to the open internet. A privacy-respecting default would be the reverse: the agent sends nothing that identifies the user unless the user turns that on. If a vendor has a good reason to send an identifier, say abuse prevention or attribution, it can ask once, in plain language, and explain who receives it.

Coding agents make this worse than a normal app. A browser tells you when you visit a site. An agent fetches pages on its own, many of them, in the middle of a task you described in one sentence. You don't see the requests, so you can't object to them. Silence is the default experience, and that is exactly why the defaults have to be conservative.

Disclosure is the bigger gap

Even if the toggle fixes this one case, the question remains: what else do agents transmit? Hostnames, machine details, project paths, session identifiers? We don't know, and for most tools neither do users. That is the real problem.

The ecosystem is already reacting. The open-source project Stroq says it can scan your past Claude Code and Codex sessions and show which keys left your machine, and it can block outbound calls carrying known secrets. We think it's a good sign that people are building such tools, and a bad sign that they're needed. Users shouldn't have to audit their own assistant with a third-party script to learn what it sends.

What vendors owe us, and what you should do

Our recommendation to vendors is simple. First, identifiers off by default and opt-in with a clear prompt. Second, a published, versioned list of what the agent sends outside the model API, including headers on web fetches. Third, a changelog that says plainly when that list changes. None of this is exotic, and a company selling a tool that people trust with their codebases and credentials can afford it.

For users, the practical steps are modest. Update to the latest release, check the plugin privacy setting mentioned above, and read the issue thread before assuming you're safe. If your address is exposed, expect more spam and treat it accordingly. If you work in a company, ask your security team to look at what your agents send before the next incident does it for them.

The lesson is bigger than one vendor. Anthropic is hardly alone in building agents that act on our behalf, and every one of them faces the same temptation to send a little more than needed. Opt-in identifiers and honest disclosure should be the baseline. Anything less asks users to trust by default, and trust is the one thing an agent shouldn't presume.