Anthropic’s Claude Code is facing privacy concerns after a user said the AI coding tool sent their email address to third-party websites through HTTP User-Agent headers during web searches without permission. The report also raises questions about how coding agents handle personal data while carrying out routine tasks.
GitHub issue points to email exposure
GitHub user taylor-edwards filed issue #107757 on November 5, 2026, and said they now receive “dozens of scam emails per day.” Their setup used Claude Code version 2.1.318 on macOS and ran inside tmux. The user asked for the behavior to be removed entirely rather than controlled through a setting.
The issue did not include a raw HTTP request, a sample header, or steps to reproduce the behavior. Other users reported similar experiences, but the public evidence does not establish that the alleged exposure caused the scam emails or affected every Claude Code user.
How the header leak would work
A User-Agent header normally identifies the software making a web request. If an email is placed inside that header, the destination website receives it with the request. In this case, the issue points to a privacy leak through routine web access rather than a reported theft of Anthropic’s account database.
The discussion points to model-written commands as one possible route. A quoted explanation in the thread says Claude used an email available in its context as a contact address when writing a curl request. That differs from the malicious traffic routing covered in unauthorized Claude Code relay services, where third parties changed client settings.
Protective module and open questions
In the GitHub issue, poteat said versions 2.1.317 and later include a built-in module called cc-plugin-privacy, designed to block this behavior. The contributor said it is enabled by default and can be disabled through /plugins. The original reporter was already using the newer 2.1.318 release.
Several commenters questioned whether the protection worked as intended. Some could not find the module, while others said harmless local tests containing their account email and User-Agent text ran without being blocked. Those tests did not transmit personal data, but they raised questions about whether the guard was active and effective.
Anthropic’s interim response
A separate comment quoted a Claude Code employee saying Anthropic planned to remove account emails from model context in an upcoming release. That statement also acknowledged gaps in the interim protection. The issue remained open when reviewed.
The episode leaves a narrow operational lesson in place: teams should review agent-written network commands and verify privacy controls before allowing web access. Earlier reporting on Claude Code security-rule bypasses shows that a configured safeguard should not be treated as proof that sensitive data cannot leave a system.
Licensed under CC BY-ND 4.0 International