Claude Code Privacy Incident: User Email Exposure in User-Agent Headers

Overview

Users of the Claude Code CLI tool have reported that the agent was leaking their personal email addresses to third-party websites via User-Agent headers. This behavior occurred during web search and API interaction tasks, leading to an increase in unsolicited spam for affected users. Anthropic has acknowledged the issue and is rolling out fixes to prevent the agent from exposing account-level identifiers in outbound network requests.

The Mechanism of Exposure

Claude Code was designed to include the user's email address in its system prompt to facilitate tasks such as authorship attribution and filtering. When the agent performed web-based tasks—such as using curl to fetch data—it would sometimes include this email address in the User-Agent string.

While some public APIs (such as those provided by the SEC) request contact information in the User-Agent header, the agent was applying this behavior broadly without explicit user consent. This resulted in the unintentional broadcasting of private identifiers to any server the agent interacted with, creating a significant privacy vulnerability.

Anthropic's Response

Anthropic has begun deploying updates to mitigate this behavior. As of version 2.1.317, a built-in module named cc-plugin-privacy was introduced to block the inclusion of sensitive identifiers in outbound requests.

Lydia Hallie, a developer working on Claude Code, confirmed that the team is actively removing the account email address from the model's context entirely. "I'm sorry we let this happen," Hallie stated, noting that the feature was originally intended to help the model handle authorship tags but failed to account for the risks of automatic transmission in network headers.

Community Insights and Workarounds

Community members have highlighted several critical takeaways regarding the use of agentic tools:

• Context Sensitivity: Users have pointed out that providing an LLM with access to personal account details creates an inherent risk of leakage. As one user noted, "Any information that they have access to is fair game."
• Verification: Users can inspect their own traffic to verify if their agent is leaking data. Some have recommended using unique, aliased email addresses for different services to mitigate the impact of such leaks.
• Defensive Measures: Until the fix is fully propagated, some users are employing custom hooks or modifying their local system prompts to explicitly forbid the agent from sharing personal identifiers.

Developer Perspectives

Discussion on the issue has focused on the tension between agent autonomy and user privacy. Many developers expressed frustration that such a feature was implemented without clear opt-in controls.

"The impression given by the desktop UI is that the LLM only has access to things explicitly added to a project. This impression is not true, as evidenced by Claude pulling data from other sessions outside a project."

Others noted that this incident underscores the need for better sandboxing. "The only way to avoid this stuff is to sandbox them and manage their context," one commenter remarked, suggesting that users should treat agentic CLI tools as having the potential to share any data they can access.