Is Claude Code leaking your email address to websites? A GitHub storm

A possible Claude Code email leak: on November 5, GitHub user taylor-edwards reported in the Claude Code repository that the agent passed their email address to third-party sites in the User-Agent header while searching the web, without their consent. Within an hour the post was on the front page of Hacker News with more than 110 points.

What actually happened in the Claude Code email leak report?

The report is titled “Bug Report: Privacy violation in User-Agent header” and concerns Claude Code version 2.1.318 on macOS. The author writes that they now get dozens of scam emails a day because Claude Code exposed their address to random sites, and that they are moving their company to the Pi agent harness with OpenRouter. They ask for the behavior to be removed entirely, not hidden behind an opt-in or opt-out setting.

Still, we need to separate the claim from the evidence. The report contains no logs and no copy of the header itself, and the link between Claude Code and the spam is the author’s own conclusion. At the time of writing there is also no reply from Anthropic under the report, though it has 33 thumbs-up reactions.

How does Claude Code know our email address at all?

This is where it gets interesting. In July, in issue #81138, a user described how Claude Code takes the address from the account (oauthAccount.emailAddress in ~/.claude.json) and adds it to the model’s context in every session, as the line “The user’s email address is …”. According to later comments in that thread:

1. Since version 2.1.246 the address comes with a caveat not to send it to unrelated services unless the user explicitly asks.
2. The address does not reach the context when we log in with an API key or use Bedrock or Vertex.
3. There is no documented setting to turn it off.

These are users’ findings from analyzing the code, and Anthropic has not confirmed them. But they explain the mechanism: Claude Code does not hard-code the address into requests; the model decides to use it on its own.

Why does the model put the address in the header?

Because some services ask for it. The Wikimedia Foundation User-Agent Policy asks for a header with contact details: an email address, a website or a wiki account. An agent that wants to be polite to the API reaches for the only address it has at hand.

And this is not the first such report:

1. #101659 from October 13: a research subagent, launched by another subagent, sent the address in the header to liquipedia.net, even though the session context forbade it. This happened on Claude Code 2.1.285 with Opus 5.5, and the server responded with a 403 error anyway.
2. #102577 from October 15: the address went to Wikipedia in four requests, after which the following ones used a generic header.

All three reports are open, and none has a comment from an Anthropic employee.

Why is this getting so much attention?

Because it touches the personal data of paying customers, and the instruction “don’t send the address” turns out to be a request to the model, not a block. In the HN comments, some people write about spam that started after they switched to Claude Code, while others see none on their unique addresses (which suggests not every case of spam has the same source). One person checked their header and did not find the address in it, so not everyone is affected.

I wrote about similar disputes over what ends up in an agent’s context when covering the Postman plugin for Claude Code.

What to watch out for from now on

1. Let’s review curl commands and network requests before approving them, especially the -A flag or the User-Agent header.
2. A PreToolUse hook can block a tool call before it runs (the hooks documentation describes this). Users in #81138 use it to reject commands containing the address, though they admit this doesn’t catch everything.
3. Adding a ban to CLAUDE.md helps, but it is still only an instruction for the model.

I write more about securing agents in my guide to AI agent security.

FAQ

Does Claude Code always send my email address?

There is no evidence of that. The reports describe individual cases where the model put the address in the header on its own, usually for services that ask for contact details. According to users, the address does not reach the context at all when logging in with an API key.

Has Anthropic responded to the reports?

At the time of writing (the evening of November 5), none of the four GitHub threads has a comment from Anthropic. On #101659 there is only a label added by a company employee.

Can I stop my email address from being passed to the model?

According to issue #81138, there is no official setting for that. Users work around it by logging in with an API key or with hooks, but those are their own workarounds, not a Claude Code feature.