# Claude Code: the agent put the user's email in User-Agent headers

> Claude Code sent the signed-in account's email address to websites in the User-Agent header, with no prompt and no setting to stop it.

- **Severity:** Low: Minor, hard to exploit or mostly theoretical. Good to know.
- **Category:** Vulnerability
- **Published by:** Anthropic
- **Disclosed:** 2026-11-05
- **Affects:** Claude Code
- **Research by:** [Taylor Edwards](https://github.com/taylor-edwards)
- **Primary source:** https://github.com/anthropics/claude-code/issues/107757
- **Page:** https://theinjection.dev/items/claude-code-user-agent-email-leak/

Claude Code added the signed-in account's email address to the User-Agent header on web requests it made, sending it to third-party sites. Version 2.1.317 added a built-in check on shell calls that carry the address.

## What happened

Taylor Edwards reported on November 5, 2026 that Claude Code had put their email address into the User-Agent header of web requests the agent made, in issue 107757 on the anthropics/claude-code repository. A Claude Code maintainer replied that nobody had implemented this as a feature and described it as model behavior.

## How it works

Claude Code builds its own web requests through shell tools such as curl, and the model chooses the headers. Some sites, Wikipedia among them, ask scripted clients to identify themselves with a contact email, and the model can read the signed-in account's address, so it filled the User-Agent with it. No code path was written to do this, which is why the maintainer shipped a deterministic check around the model rather than removing a feature.

## Who is affected

Claude Code users signed in with an account whose address the model can read are exposed, and the report lists version 2.1.318 on macOS. The privacy mod's README says it matches only Bash, PowerShell and Monitor calls that name a User-Agent, so the paths listed below stay uncovered.

## What to do

Update Claude Code to 2.1.317 or later and leave the cc-plugin-privacy mod enabled, since it can be turned off through /plugins or settings. For the paths it does not cover, a commenter in the thread adds a CLAUDE.md rule that allows the address in a User-Agent only for named, approved sites.

## Quick facts

- **Affected:** Claude Code before 2.1.317
- **Reported by:** Taylor Edwards, in issue 107757
- **Disclosed:** November 5, 2026
- **Status:** Mitigated by the built-in cc-plugin-privacy mod in 2.1.317
- **Mitigation covers:** Bash, PowerShell and Monitor calls that name a User-Agent
- **Not covered:** WebFetch, WebSearch, MCP tools, the address in a URL or request body

## Sources

1. [GitHub Issue 107757](https://github.com/anthropics/claude-code/issues/107757)
2. [Privacy Mod Source](https://github.com/anthropics/claude-code/tree/main/mods/privacy)
3. [Claude Code Changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md)