Claude Code Email Leak: AI-Written Web Requests Exposed Users' Addresses in User-Agent Headers, What Is Confirmed and What to Check

Claude Code, Anthropic's AI coding tool, has sometimes put the signed-in user's email address into web requests it wrote and sent to other websites. If your developers use it, a work address may have reached sites nobody chose to share it with, and the permanent fix had not appeared in the release notes as of November 8, 2026.

What happened with the Claude Code email leak

On November 5, 2026, GitHub user taylor-edwards opened issue #107757, saying Claude Code "divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission."

A User-Agent is a short label a program sends to say what it is. Some sites ask automated tools to include contact details in it. The crates.io policy recommends that, and the SEC's EDGAR guidance shows an administrator's email in its sample header. Reports describe the AI following that convention with the address it had on hand.

This was not the first report. Issue #78431 raised the same symptom on July 17 and was closed as not planned by an automated bot on September 11. Issue #95258 followed on September 18 and issue #106012 on October 29.

What is confirmed about the Claude Code email leak

• The behavior happened. A commenter who says they work on Claude Code wrote on Hacker News that "when Claude wrote a command itself, like a curl call, it sometimes put your email address in the User-Agent," and added, "I'm sorry we let this happen."
• Why the address was available. The same comment says the account email was added to the model's context for signed-in users, after Claude was reported inventing names for things like @author tags.
• A check shipped. The release notes for version 2.1.317, dated November 3, say: "Added a check that asks before a web or shell tool call sends your account email address to the network."
• A removal is promised. The comment says, "We're removing the account email address from the context Claude Code gives the model," in the next release, "which should arrive early next week." The newest changelog entry we read on November 8 was 2.1.319, dated November 6, and it does not mention this.

What is claimed but not confirmed

• The scam emails. The reporter says they now get dozens of scam emails a day because of this. The issue includes no captured request or steps to reproduce, so that link is unproven.
• Web searches. The reporter says it happened during web searches, but does not show which tool sent the header. The Hacker News comment describes commands Claude wrote itself.
• Scale. The reporter of issue #106012 counted 15 such requests across 4 projects, sent to sec.gov and bls.gov. That is one person's count. No total has been published.
• The source of the address in every case. On the older issue #78431, one commenter said that Claude, when asked, named git config as the source. That is an AI explaining itself, not evidence. Another commenter there could not reproduce the behavior on version 2.1.212.
• Legal exposure. A commenter on #107757 called this a likely GDPR violation. That is an opinion, and we found no regulator or court saying so.

We found no formal Anthropic advisory as of November 8. The reports we read concern the email address only, and none describes a break-in at Anthropic.

Is the Claude Code email leak fixed?

Not fully. The check in 2.1.317 narrows the problem and does not close it. The README for the built-in privacy mod, cc-plugin-privacy, calls it "a courtesy, not a boundary." It refuses shell commands that contain the address and name a User-Agent. It also lists what gets through, including the address in a URL, a request body or a From: header, and values computed at run time such as $(git config user.email). It adds: "WebFetch and WebSearch are not checked."

The descriptions do not all match. The release notes and the Hacker News comment say the check asks first and covers web tool calls. A contributor on GitHub says it will "deterministically block" the behavior. The README says shell calls are refused with no prompt and web tools are not checked. Plan around the narrowest reading, and test your own install.

The Hacker News comment also says the check "still doesn't prevent all cases, like when Claude writes a script and runs on its own." The original reporter listed version 2.1.318, which should include the check, but the issue does not say whether the exposure happened on that version.

What to do this week: Claude Code email leak checklist

How to check if Claude Code sent your email

Claude Code keeps plaintext transcripts under ~/.claude/projects/, for 30 days by default. On each machine, search them, replacing the sample address with the account address:

grep -rhoiE '.{0,60}(user-agent|curl -A|wget -U).{0,120}you@yourcompany\.com' ~/.claude/projects/

A hit shows the address next to a User-Agent, so confirm the command actually ran. No hits is not proof of safety: older transcripts age out, and a script can set the header in other ways. Firewall logs usually will not help, because User-Agent headers travel inside encrypted HTTPS unless you run TLS inspection.

Why this matters for a company network

An email address is not a password. But in another site's logs, it ties a named employee to what they were looking up, and it gives whoever reads those logs a real address to phish.

The deeper issue is control. Issue #106012 quotes the note Claude Code attached to the address: "Never send it to an unrelated service." The reporter says it went out anyway. A written instruction to an AI is not a security control. If your company relies on AI-built tools and agents, the limits that count are the ones enforced outside the model.

The release channel gap makes a familiar point too: updated is not the same as patched. A machine can be current on its channel and still lack the version with the check.

Claude Code email leak questions people are asking

Does Claude Code send my email to websites?

Sometimes. The confirmed path is a command Claude wrote itself, such as a curl call with your address in the User-Agent. It is not described as happening on every request.

Which Claude Code version fixes the email leak?

None fully, as of November 8, 2026. Version 2.1.317 added a partial check, and 2.1.319 was the newest listed. Removal of the address is promised for an upcoming release.

How do I stop Claude Code sending my email?

Update to 2.1.317 or later, keep the built-in check on, limit which sites Claude Code can reach, and install the removal release when it ships.

Was my password or source code exposed?

The reports we read concern the email address only. They do not describe passwords or source code leaving this way.

Can I see if my email was exposed?

Partly. Local transcripts can show commands from about the last 30 days. They cannot show what a website kept.

The bigger lesson

An AI agent can use whatever it is handed, in ways nobody planned. Decide what goes into its context, and enforce what it can reach with controls outside the model.

Want that reviewed for your company? See our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: GitHub issue #107757; Claude Code changelog; Claude Code privacy mod README; Hacker News comment from a Claude Code team member; GitHub issue #78431; GitHub issue #95258; GitHub issue #106012; Claude Code setup docs; Claude Code sandboxing docs; Claude Code permissions docs; Claude Code .claude directory docs; crates.io policy RFC; SEC EDGAR access guidance.