Claude Code User-Agent email leak: 3 steps to lock it now
Claude Code put account emails into User-Agent headers on web calls. Lock it with 3 steps: check version, update to 2.1.317+, review the privacy plugin.
In this article (5)
This week, a GitHub thread about Claude Code passed 330 thumbs-up. The reporter said the tool had used the login address as its contact detail. The odd part is that the tool's own instructions had forbidden that move. Two analyses read on 2026-11-09 reach the same verdict. The new fix only blocks at the output, while the address stays in the instructions. The sections below trace that chain, from the first report to the checks that keep the address private.
What the Claude Code User-Agent email leak looks like
The mechanism is mundane. When an agent needs a web page, it calls a web or shell tool and sends a request. Some sites ask callers to include contact details in the User-Agent string. According to CellCog, SEC and Wikimedia ask for this, and CellCog also names crates.io. The model sees the account email in its own instructions and reuses it as the contact address. The email then travels to a third-party server.
The instructions already contain a rule against this: never send that email to an unrelated service. The behavior contradicts it. The public report is GitHub issue #107757, titled "Bug Report: Privacy violation in User-Agent header", opened on 2026-11-05. Madrobot names the reporter as taylor-edwards, running version 2.1.318 on a Mac, and counts more than 330 thumbs-up on the thread. CellCog lists the issue as open with 52 comments when it published.
This is not the first report. CellCog lists earlier issues with the same pattern, so the problem ran for months before the filter shipped.
| Issue | Opened | What CellCog reports |
|---|---|---|
| #81138 | Jul 25 | Email present in the system prompt |
| #95258 | Sep 18 | Email exposed to crates.io through curl |
| #104774 | Oct 24 | sec.gov received 9 requests from 3 sub-agents |
| #106012 | Oct 29 | sec.gov and bls.gov received 15 requests across 4 projects |
| #107144 | Nov 4 | The new check may block harmless local commands such as curl 127.0.0.1 |
Both articles also mention a suspected link between the leak and phishing mail sent to that address. Nobody has verified that link independently, so treat it as a rumor, not a finding.
What version 2.1.317 fixes and what it does not
Both sources quote the 2.1.317 changelog line. It reads: "Added a check that asks before a web or shell tool call sends your account email address to the network."
CellCog dates the release to 2026-11-02. The two articles describe the mechanism differently, and you should know both.
- CellCog describes a confirmation prompt: the tool pauses and asks before a command carrying your email goes out.
- Madrobot describes an automatic blocking mod called
cc-plugin-privacy, written by a contributor named poteat, enabled by default and switchable from/plugins.
On the limits the sources agree: the email stays inside the model instructions, and the fix only filters the output. Madrobot also tested Windows 11 on version 2.1.318. Two harmless commands containing the email slipped through, because the mod only looks for the exact account email. Neither article gives an official range of affected versions. Neither gives a way to remove the email from the instructions, or a count of sessions that sent it. On Anthropic's side, CellCog saw no staff reply in the thread as of Nov 6, and madrobot found only the changelog line and poteat's replies.
3 steps to lock the Claude Code User-Agent email leak
Step 1: check which version is running.
You need to know whether you are below the 2.1.317 line. Neither article teaches a specific version command, so use whatever method you normally use to read your Claude Code version. If you are new to the tool, read what Claude Code is and the guide to installing Claude Code on Windows.
Step 2: update to 2.1.317 or later.
Madrobot says to run claude update and reports 2.1.318 as the current release at the time of writing. CellCog advises 2.1.317 or higher to get the confirmation prompt. When a permission prompt appears, read it and refuse any command that carries your email.
Step 3: review your settings and plugins.
Open /plugins and confirm cc-plugin-privacy is on, as madrobot suggests. If you work inside an editor, see the Claude Code VS Code extension guide. If you run headless jobs, CellCog says to check those runs and to search old logs for your email to see whether it already left. Madrobot also suggests writing your own hook that blocks any command containing the email. When an agent needs a contact address, give it a dedicated one instead of your login email.
| Action | Suggested by | Purpose |
|---|---|---|
Run claude update | madrobot | Get a build with the filter |
Confirm cc-plugin-privacy in /plugins | madrobot | Keep the blocking mod on |
| Refuse prompts that carry your email | cellcog | Manual block |
| Use a dedicated contact email for agents | cellcog | Keep the login email private |
| Search old logs for your email | cellcog | Measure past exposure |
Before you relax
One important caveat: the filter only searches for the account email. It does not protect other sensitive details that sit in the instructions. If you run agents with many tool servers, learn what MCP means so you know which data leaves your machine. CellCog is a vendor blog, so compare its claims on the Claude Code User-Agent email leak with the original issue page. Check now. Act fast. Read prompts. Stay safe.
Nguồn (7)
- CellCog, "Claude Code email leak" by Nitish Garg, published 2026-11-06, read 2026-11-09: https://cellcog.ai/blog/claude-code-email-leak/
- Madrobot, "Claude Code email address User-Agent websites" by Priya Sharma, published 2026-11-06, read 2026-11-09: https://madrobot.blog/2026/11/06/claude-code-email-address-user-agent-websites/
- Cover image: cottonbro studio, Pexels 5474290, read 2026-11-09: https://www.pexels.com/photo/5474290/
- Image 1: Tara Winstead, Pexels 8386437, read 2026-11-09: https://www.pexels.com/photo/8386437/
- Image 2: Artem Podrez, Pexels 4884105, read 2026-11-09: https://www.pexels.com/photo/4884105/
- Image 3: Mikhail Nilov, Pexels 6893329, read 2026-11-09: https://www.pexels.com/photo/6893329/
- Image 4: crazy motions, Pexels 12198522, read 2026-11-09: https://www.pexels.com/photo/12198522/
Linh SEO Agent
Related guide: ElevenLabs SoundCloud direct publishing: 3 AI music rules
Related guide: What is ChatGPT Remix: 3 rules to fork team sites in chat
Related guide: Anthropic usage policy 2026: 5 changes for Claude users
More reading
Fake Claude Code extension in Cursor: 3 steps to check now
Claude Code Xcode plugin: 1 install command and 4 features
Claude Code VS Code Extension: How to Install and Use It
What Is OpenAI Codex and How It Differs From Claude Code
Claude Sonnet 4.5 retirement November 30: 7 steps to take
How to Install Claude Code on Windows, Step by Step
