On November 5, 2026, issue #107757 was filed in the Claude Code repository. The reporter says their email address was sent to third parties in the User-Agent header during web searches, and that they began receiving scam emails afterward. The issue is still open.

This article relies on the issue text, its comments, and the release notes. We did not reproduce the issue ourselves.

Who writes the header

User-Agent is a header an HTTP client sends to identify itself. Browsers send a fixed format. Agent tools can behave differently. When a web search tool or a command such as curl runs, whoever composes the header string determines whether personal data goes into it.

The issue states that an email went into the header, but it does not establish which path put it there: the harness filling in a value automatically, or the model writing it while building a request. The comments do not settle this either. This article therefore does not assign a cause and only describes what is confirmed.

The maintainer's answer: the 2.1.317 privacy mod

A maintainer's reply says v2.1.317 added a built-in mod, cc-plugin-privacy, with these properties:

  • It is enabled by default.
  • It can be turned off through /plugins.
  • Its purpose is to stop the account email from appearing in the header.

This is not the same as the issue's main request, which was to remove the behavior from the harness rather than leave it as an opt-in or opt-out setting. The protection remains a configurable feature.

The remaining gaps reported in comments

Later comments reported that the protection is not complete. Grouped by category, the reports are:

  1. Only the account address is matched. Strings the model composes, such as a User-Agent that includes a project or task name, may not be covered.
  2. Writing the header from a shell script was reported as not blocked. This was reported against v2.1.319, where the email appeared when a command wrote the header through a script rather than passing it as direct input.

We do not reproduce the specific command here. The point for readers is the class of problem: a check that matches one exact string can miss the same value written in a different form. We did not verify whether the gap still exists in the current version.

A commenter also proposed that model-composed requests default to a generic User-Agent such as claude-code/<version>. This is a proposal. We found no evidence that it was adopted.

Checking your own setup (not run)

To check your own environment, you could do the following. We did not run these steps.

  • Start a small local HTTP server that logs request headers. Do not send the logs anywhere external.
  • Sign in with a test account rather than a real personal address.
  • Trigger a web search or HTTP request from the agent, and read the User-Agent value in the server log.
  • Mask values before sharing any log.

Keep this testing limited to accounts and logs you control.

What a team can do

  • Update and confirm the mod. Use a version that includes the privacy mod, and check that /plugins has not disabled it.
  • Minimize account data. If the agent environment does not need a personal email, use a team account or an alias.
  • Mask logs. Add a rule that redacts email patterns in agent logs and request records.
  • Set an outbound-request policy. Record which headers leave the machine when an agent reaches external sites, and review any field that could carry personal data.

Limits

  • The sources are the public issue, its comments, and the release description. We did not inspect real network traffic.
  • Reproduction reports in comments depend on each reporter's environment.
  • The exact path by which the email reaches the header, whether harness or model, is not settled in the issue.
  • The issue is open, so the status described here is as of writing.

Conclusion

The lesson here goes beyond one Claude Code bug. Agents make many HTTP requests the user never sees, and their headers and command bodies can carry personal data. Turning on a protection is necessary, but so is a habit of checking what the requests actually contain.

Reference