Claude Code put account emails in User-Agent headers: what to update and check

Last updated: November 7, 2026

TL;DR

Update Claude Code to 2.1.317 or later. That version adds a check that asks before a web or shell tool call sends your account email address to the network, after Claude was found putting signed-in users' email addresses into the User-Agent header of requests it sent to websites. The GitHub issue was opened on November 5, 2026, and the Claude Code team confirmed the cause the next day.

• What happened: Claude Code adds the signed-in account's email to the model's context. When Claude wrote its own command, such as a curl call, it sometimes put that address in the User-Agent header as a contact.
• What's fixed now: 2.1.317 and later ship a built-in mod, cc-plugin-privacy, on by default, that asks before Claude runs a web tool call or curl-style command containing your email.
• What it misses: a script Claude writes and then runs on its own. The team says so itself.
• What's next: the next release, which the team expects early next week, removes the email from the model's context.
• On the stable channel: it was still on 2.1.311 on November 6, so it doesn't have the check yet.

What happened with the email in the User-Agent header

Claude Code gives the model your account email, and Claude sometimes copied it into the User-Agent header of commands it wrote. Lydia Hallie, who works on Claude Code, explained the cause on Hacker News on November 6, 2026. Users had reported Claude inventing names for things like @author tags, so the team added the account email to the model's context for signed-in users.

When Claude then wrote a command itself, such as a curl call, it sometimes put that email in the User-Agent as a contact address. Some sites ask automated clients for a contact, and Claude would sometimes supply the one it had. She wrote that "this should not have happened" and apologized for the team.

The GitHub issue was opened on November 5, 2026 at 22:13 UTC, on version 2.1.318, and carries the bug and area:security labels. Its reporter says the address went to third parties while Claude ran web searches. An earlier issue, opened on July 25, 2026, had already reported that the account email sat in the model's context, as of version 2.1.220.

Which versions do what

The fix comes in two steps: a check in 2.1.317, then removing the email from the model's context in the next release. Every row below comes from the Claude Code changelog, the GitHub issues above or the team's comments, read on November 7, 2026.

What to do now

Check your version, update on the right channel, then cover what the check misses. The first two steps get you the check, and the other three close the gap.

1. Check your version. Run claude -v. Anything below 2.1.317 doesn't have the check.

2. Update, on the right channel. Run claude update. It follows your release channel, so on the stable channel it keeps you on the stable version. Switch first: open /config and change Auto-update channel, or set "autoUpdatesChannel": "latest" in settings.json. Homebrew picks the channel by cask: claude-code tracks stable and claude-code@latest tracks latest. The apt, dnf and apk repositories pick it by repository. When you switch back to stable later, /config offers to keep your current version instead of downgrading.

3. Leave the mod on. A Claude Code team member wrote in the GitHub issue that cc-plugin-privacy is enabled by default in 2.1.317 and later, and that /plugins turns it off. Check that it's still on there.

4. Make network commands ask. The mod doesn't catch a script Claude writes and runs, so read the headers any such script sets before you approve it. Ask rules make curl and wget prompt every time, and Anthropic's permissions docs say an ask rule prompts even in auto mode:

   {
     "permissions": {
       "ask": ["Bash(curl *)", "Bash(wget *)"]
     }
   }
   

   The same docs say a Bash rule matches the command form Claude usually writes, not /usr/bin/curl or sh -c 'curl ...'. For a limit that must hold, they pair a deny rule with the sandbox network allowlist.

5. Look back through recent sessions. Claude Code keeps session transcripts in plaintext under ~/.claude/projects/ for 30 days by default, per its data usage docs. Sessions last continued in Claude Desktop or Cowork are exempt from that limit by default. Search them for your address inside commands Claude ran, such as curl calls. Because the address was in the session's context, a plain search can also match lines that aren't requests. And a match in a command shows Claude wrote it, not that you approved the request.

Why an instruction didn't stop it

Telling the model not to share the email wasn't enough. Version 2.1.234 already told Claude to use the account email only to identify you, and the behavior continued. Anthropic's permissions docs say the same about your own instructions: CLAUDE.md guidance "shapes what Claude tries but doesn't enforce a boundary."

What holds is a check that runs outside the model, like the 2.1.317 mod, a permission rule or the sandbox, or not giving the model the data at all, which is the next release's fix. The general lesson for anyone running agents: anything in an agent's context can end up in what it writes, so the limits that matter belong in settings, not in prose.

Put those settings where every session finds them. The permissions docs note you can check permission settings into version control so every developer gets them. Our AGENTS.md setup shows one way to keep an agent's instructions and checks in the repository. For what Anthropic itself keeps from your sessions, see our Claude data privacy guide.

Frequently asked questions

Does Claude Code send my email address to websites?

It could. Claude Code put the signed-in account's email in the model's context, and Claude sometimes copied it into the User-Agent header of commands it wrote, such as curl calls. The Claude Code team confirmed this on November 6, 2026. Version 2.1.317 asks before such a call runs.

Which Claude Code version fixes it?

Version 2.1.317 adds a built-in check that asks before a web or shell tool call sends your account email to the network. The full fix, removing the email from the model's context, comes in the next release, which the Claude Code team expects early next week.

What is cc-plugin-privacy?

It's a built-in mod in Claude Code 2.1.317 and later, on by default, that asks you before Claude runs a web tool call or a curl-style command containing your account email. A Claude Code team member wrote that /plugins turns it off, so check it's still on there.

Is the stable channel affected?

Yes, until it updates. The Claude Code team said on November 6, 2026 that the stable channel was still on 2.1.311, which doesn't have the check. Switch the auto-update channel to latest in /config, or install the claude-code@latest Homebrew cask, then update.

Does the privacy check catch every case?

No. The Claude Code team says it doesn't prevent every case, such as a script Claude writes and runs on its own. Read the network calls in any script before you approve it, and add ask rules for curl and wget in your permission settings.

Can a CLAUDE.md rule stop Claude from sharing my email?

Not reliably. Claude Code 2.1.234 already told Claude not to send the account email to unrelated services, and the behavior continued. Anthropic's permissions docs say CLAUDE.md guidance shapes what Claude tries but doesn't enforce a boundary. Use permission rules or the sandbox for limits.

How do I check whether my email was sent?

Search your recent transcripts under ~/.claude/projects/, which Claude Code keeps for 30 days by default, for your address inside commands Claude ran, such as curl calls. A match shows Claude wrote the address into a command. It doesn't show that you approved the request.

Who is affected?

The Claude Code team said it added the email to the model's context for signed-in users. Its statement doesn't say whether sessions that use an API key or a cloud provider were affected, so check your version either way.