When a Web Request Carries Your Inbox With It
When your AI coding assistant does research for you, it has to identify itself to the sites it visits. Usually that means a User-Agent string — the same kind of header every browser sends. But what happens when the assistant's identity includes your personal email address?
That is exactly what happened with Claude Code. A report in November described a user's email address being passed to websites in the User-Agent header during web searches, and the fallout that followed — including what the user described as dozens of scam emails a day.
In this post: what the leak actually was, how an email ended up in a web request header, what Anthropic shipped to fix it, and the settings you should check today so it doesn't happen to you.
The Report: An Email Address in the User-Agent Header
The story surfaced in November, when a Claude Code user reported that their email address had been included in the User-Agent header of web requests made during the tool's web search. The user linked the exposure to a sharp increase in unwanted mail, describing dozens of scam emails a day after the leak.
The detail that made the report alarming was not the volume alone. A User-Agent header is sent on every request, and it is written to the receiving server's logs. An email address in that header is handed to every site the tool visits, whether or not the site needs it — and to any third party that later sees those logs.
The pattern is plausible because of how Claude Code is built. The tool places the signed-in user's email into the model's context at the start of each session, with an instruction to use it only for identification. Some websites — Wikipedia and the SEC are the named examples — ask automated visitors to include a contact address in their requests. When the model saw one of those requests, it could comply by reaching for the only address it had: yours.
For a fuller picture of how these coding assistants work — and where the data you give them can travel — see our guide to AI coding tools and their privacy risks.
Why This Leak Matters More Than It Looks
An email address on its own is not a password. But a live, confirmed address in the wrong hands is the raw material for the most common attacks on the internet:
- Phishing and impersonation. A sender who knows your address and that you use Claude Code can craft believable messages about your subscription, your API usage, or a "security update".
- Credential stuffing. If the address matches an account elsewhere, it becomes the username half of a login attempt.
- Spam and scam volume. Once an address is confirmed active — for example, because a site logged it and the log leaked or was shared — it tends to stay on lists.
- Correlation. The same address appearing in logs across different services links those activities to one person.
The uncomfortable part is that none of this requires a breach of Anthropic's servers. The address was handed over in the normal operation of a feature the user had asked for: web search.
What Anthropic Shipped: The cc-plugin-privacy Plugin
Anthropic's fix arrived in Claude Code version 2.1.317, in the form of a built-in plugin named cc-plugin-privacy. The plugin watches shell tool calls and refuses — or holds for your approval — any call that would send your account email to the network. It ships enabled by default, so most users get the protection simply by updating.
The plugin's own documentation is candid about its limits. It describes itself as "a courtesy, not a boundary", and it covers shell tools only. WebFetch, WebSearch and the MCP tools are not checked by it — so the fix closes the most common path, not every path.
That is an important distinction. If your workflow leans on WebFetch or WebSearch, the plugin alone does not guarantee your address stays local. You need to check what those tools are actually sending, which is where the steps below come in.
For the background on how servers use these headers — and how much a User-Agent string can reveal — see our explainer on the User-Agent header.
Check Your Setup in 5 Minutes
Run through these checks now, and repeat them after every Claude Code update:
- Update first. Make sure you are on Claude Code 2.1.317 or later. Older versions do not include the privacy plugin at all.
- Confirm the plugin is present and enabled. Open
/pluginsin Claude Code and look forcc-plugin-privacy. At least one user on 2.1.318 reported not seeing it, so verify rather than assume. - Pin an approved alias in CLAUDE.md. If a site genuinely needs a contact address, give the model one that is safe to share. Add a line such as: "If a site requests a contact email, use
claude@example.com— never use my personal email address." - Watch your inbox. A sudden jump in scam or phishing mail after using web search is a signal worth investigating, not a coincidence to ignore.
- Consider an alias for AI tools generally. A dedicated address for AI services means a future leak exposes the alias, not your main inbox.
The Fix Has Limits — Know Them
Because the plugin watches shell calls only, three paths remain open:
| Path | Covered by cc-plugin-privacy? | What to do |
|---|---|---|
| Shell tool calls (curl, etc.) | Yes — refused or held for approval | Keep the plugin enabled and review held calls |
| WebFetch | No | Avoid fetching sites that request a contact address, or use your alias |
| WebSearch | No | Same as WebFetch — the tool that produced the original report |
| MCP tools | No | Check what each MCP server sends before connecting it |
If you need a guarantee that your email never reaches a website through the tool, the current fix does not provide one. The November reporter reached the same conclusion and switched to a coding harness that never loads their address into context. That is a reasonable response — and it is a reminder to verify the defaults of every AI tool you use, because this pattern is not unique to Claude Code.
Want to compare your options? Our roundup of the best AI coding tools for 2026 covers the privacy trade-offs of the main alternatives.
Frequently Asked Questions
Quick answers to the questions readers ask most about this leak.
Did Claude Code leak my email address?
Not necessarily yours. The leak happened when Claude Code was asked to research sites that request a contact email in the User-Agent header, such as Wikipedia and the SEC. If you only used it for local coding and never asked it to fetch the web, your address likely never left your machine. If you asked it to research those sites before version 2.1.317, assume it may have been sent and watch for unusual mail.
How did the email get into the User-Agent header?
Claude Code places your signed-in email in the model's instructions at the start of every session, with an instruction to use it only for identification. When a site's policy asked for a contact address, the model sometimes complied by putting your address into the User-Agent header of a curl request. The instruction was a line of text, not a technical control, so it could be overridden by the site's request.
What did Anthropic change in version 2.1.317?
Version 2.1.317 added a built-in plugin, cc-plugin-privacy, that watches shell tool calls and refuses or holds for approval any call that would send your account email to the network. It ships enabled by default. Its own documentation calls it "a courtesy, not a boundary": it covers shell tools only, so WebFetch, WebSearch and MCP tools are not checked.
How do I check the privacy plugin is enabled?
Update Claude Code to 2.1.317 or later, then open /plugins and confirm cc-plugin-privacy is listed and enabled. At least one user on 2.1.318 reported not seeing it, so verify rather than assume. If it is missing, update again and check the changelog for your exact version.
Can I get my email back from sites that already received it?
No. Once a header has been sent, there is no recall mechanism — the receiving site has your address in its logs. What you can do is reduce the damage: watch for phishing and scam mail, consider filtering or retiring the address if the volume becomes unmanageable, and use a dedicated alias for AI tools going forward so a future leak exposes the alias, not your main inbox.
Should I switch to a different AI coding tool?
That depends on your tolerance. If you need a guarantee that your email never reaches a website through the tool, the current fix does not provide one, and switching to a harness that never loads your address into context is a reasonable response — the November reporter did exactly that. If you mainly want the common leak blocked, updating to 2.1.317, verifying the plugin, and pinning an approved alias in CLAUDE.md is a proportionate fix. Either way, verify the defaults of whatever tool you choose, because this pattern is not unique to Claude Code.
Comments
No comments yet. Be the first to share your thoughts below.