Claude Code could send your email address to websites

Claude Code could send your email address to websites without you asking it to. This was not an ordinary tracking script. Anthropic itself put the account address into the context the model could read.

When Claude generated a network command, the model could reuse that address as contact information in the User-Agent field. The website at the other end could then receive and log the email address even though the user had never filled out a form or included the address in the task.

Anthropic has acknowledged what happened and said the address would be removed from the model context in the next release. In the meantime, Claude Code 2.1.317 introduced a built-in privacy filter. The problem is that Anthropic’s own description explicitly says it covers only one particular form of leakage. This is not acceptable. You do not give an agent personal data and then protect it with a narrow text check that the company itself calls a courtesy, not a security boundary.

What did Claude Code send to websites?

Claude Code could put the email address associated with the signed-in Anthropic account into a custom User-Agent. That field accompanies an HTTP request and usually identifies the client visiting a website. In this case, it could also contain a private contact address.

A User-Agent is not hidden from the recipient. HTTPS protects traffic while it travels between your machine and the website, but the website’s server, CDN or other infrastructure terminating the connection can read the header. The address may then remain in access logs long after the request has finished.

The issue was opened on November 5, 2026 and was labeled security, tools, bug and macOS. The reporter was using Claude Code 2.1.318 and said the address had been sent to arbitrary third parties during web searches. The report also connected the incident to a sharp increase in scam email, but that causal link has not been established. The confirmed finding is the exposure itself, not who may later have used the address.

Why did the model have the email address at all?

Anthropic placed the account address in the model context for signed-in users. The reason was that Claude had previously invented names in places such as @author fields. Information intended to help with authorship and identification was therefore made available to the same model that could write and run network commands.

A member of the Claude Code team explained publicly on November 6 that Claude sometimes used the address as contact information when generating a command, such as a curl request. Some websites ask automated clients to provide a contact, and Claude could choose the address already sitting in its context.

The failure chain is frighteningly simple: give the model a real piece of personal data, tell it that the data can be used for identification, and let the same model improvise commands that go out to the internet. An instruction not to send the address to third parties is not a solid security boundary. If the model does not need the address for the task, it should not have it.

Did every request leak the address?

No. There is no evidence that Claude Code automatically attached the email address to every single web request. Its ordinary client identity could look like Claude-User (claude-code/2.1.318; +https://support.anthropic.com/), with no email address included.

The problem appeared when the model generated a command or script and chose to use the account address as contact information. That makes the incident narrower than a client that hard-coded the address into all traffic, but it does not make it harmless. An agent works by creating new commands and adapting to the site it encounters. The user cannot know in advance which variation the model will invent.

The issue also does not establish how many websites received addresses, how many users were affected or how often the behavior occurred. Those limits matter. At the same time, the Claude Code team confirmed the mechanism and apologized for allowing it through. This is more than an unverified suspicion from a comment thread.

What does the privacy filter in 2.1.317 do?

Claude Code 2.1.317 and later include a built-in module called cc-plugin-privacy. It checks Bash, PowerShell and Monitor commands. If the text contains both the signed-in account address and words or flags that look like a User-Agent, the call is denied.

The filter is active by default. The Claude Code team advised users to update to at least 2.1.317 because the stable channel was still on 2.1.311 when the team responded. You can check your installed version with claude --version and look for the built-in module under /plugins.

That sounds reassuring until you read Anthropic’s published source code and README. The documentation says directly that the filter is a “courtesy, not a boundary” and that it covers only one shape of the problem. That is a long way from saying the underlying risk has been fixed.

The check can stop a visible curl -A command containing the account address, but it does not cover WebFetch, WebSearch or MCP tools. It can also miss the address in a URL, request body, From header or a script executed as a separate file. Values retrieved at runtime, such as an address from git config user.email, are another documented opening. An installed plugin can even override the denial.

Why is the temporary fix too weak?

In practice, the privacy module looks for two text patterns in the same tool call: the account address and something resembling a User-Agent. It does not analyze where the data is actually going. That means it can block an innocent local command while missing other ways the address can leave the machine.

This is a textbook example of why a filter around an agent cannot repair a bad decision inside the context. As long as the model receives the private address, it can write it to a file, embed it in a script, retrieve it through a variable or use a protocol and header the filter does not recognize. Additional permission prompts may reduce risk, but they do not remove the data source.

The correct fix is the one Anthropic has announced: remove the account address from the model context. Then Claude cannot casually reuse that specific piece of information. This will not solve every possible data leak from an agent that can read files and access the web, but it closes the unnecessary channel Anthropic opened itself.

What should you do if you use Claude Code?

Update to at least 2.1.317 and confirm that cc-plugin-privacy is active. That provides a useful temporary barrier against the best-known version of the leak. Do not disable it simply to force a command through before understanding why the call was blocked.

Then treat the filter for what it is: temporary. Read network commands before they run, especially custom headers, URLs, request bodies and scripts that receive internet access. Do not approve a private contact address merely because a website asks an automated client to identify itself. If a service genuinely requires contact information, choose a public project address or contact page created for that purpose.

Do not assume that one permission prompt covers an entire workflow either. Claude can write a script in one step and execute the file in the next. The filter’s own documentation says that a script containing the address may pass when the tool call itself only refers to the file.

If you have seen Claude Code generate network commands containing your email address, assume that the receiving website may have stored it. Preserve the command log, note which domains were contacted, and notify the website or Anthropic where appropriate. Do not publish raw logs with the address still visible when documenting the bug.

Anthropic chose the wrong security boundary

The serious part is not that a language model invented an odd User-Agent. Anthropic made a private account address part of the agent’s working context to solve the much smaller problem of invented author names. Once the model used that information in a network command, the result was a predictable consequence of the design.

Anthropic explained the cause, apologized and said the address would be removed. None of that makes the temporary module stronger than it is. The company’s own documentation lists the holes. As of November 6, the promised removal had not been confirmed as shipped, and the GitHub issue remained open.

Trust is the product when an agent can read code, run commands and retrieve content from the web. The default setup cannot hand the model a private email address it does not need and then hope a text filter catches every dangerous variation. Remove the data at the source. Everything else is a bandage.

Frequently asked questions