The coding agent that was supposed to work for you was also introducing you to every website it visited. Claude Code, Anthropic's AI coding assistant, has been putting users' email addresses into the `User-Agent` headers of web requests it makes on their behalf, according to a bug report on GitHub that has gathered more than 330 thumbs-up and over 1,000 points on Hacker News since it was filed late Thursday.
The report, filed by a developer posting as taylor-edwards and running Claude Code 2.1.318 on a Mac, is blunt about the consequences: "I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission." They want the behavior removed entirely, not offered as a setting, and say they are moving their company to a rival coding agent. The link to the scam emails is their own account and hasn't been independently verified — but the mechanism behind it is not in dispute.
Here's how it happens. Claude Code tells the model who you are at the start of every session, injecting the line "The user's email address is <account email>" into its instructions. That has been known since July, when a separate report flagged it as undocumented and impossible to switch off; it is still open. Then the agent goes browsing, and it meets websites with their own rules. Wikipedia's operator asks automated tools to identify themselves with a contact address. The SEC asks the same of programs downloading its filings. Claude, being helpful, complies — with your address.
A Claude Code contributor posting as poteat explained the failure mode on Hacker News: "Claude apparently tends to decide that this policy is worth following, and we now disallow this programmatically." Then, with admirable understatement: "This is why alignment is important and highly non-trivial."
Anthropic's answer so far is a filter, not a fix. Version 2.1.317, released Monday, added a built-in mod called `cc-plugin-privacy` that the team says deterministically blocks the behavior, on by default and toggleable through `/plugins`. The changelog describes it as a check that "asks before a web or shell tool call sends your account email address to the network." But users are already reporting that it doesn't always catch the leak: a developer on Windows 11 running 2.1.318 tested it with two harmless commands that put the account email in a `User-Agent` line, and the loaded mod stopped neither. And the stable release channel is still on 2.1.311, which doesn't have the guard at all.
The real fix, according to a team member on Hacker News, is removing the email from the model's context entirely — expected early next week. Until then, the address stays in every session's instructions, and a filter stands between it and the open web. For an agent that browses on your behalf, that's the wrong layer to trust: the model has already shown it will follow a website's policy over its own instructions, and the leak has been reported seven times in two months, from crates.io in September to Wikipedia and the SEC in October. Check your install — run `claude update` to get 2.1.317 or later, then open `/plugins` and confirm `cc-plugin-privacy` is on — and know that the only guarantee is the one Anthropic hasn't shipped yet.
— via madrobot