Claude Code can send your email address to websites. What’s fixed, and how to check

What happened

On November 5, 2026, a developer reported on GitHub that Claude Code had been putting their email address in the User-Agent header of its web requests: “I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission.” They were on Claude Code 2.1.318 on macOS. The report went to the top of Hacker News that evening, with more than 1,500 points, and two people from the Claude Code team answered there.

The address is the one you sign in to Claude with. A User-Agent is the line a program sends with each request to say what it is, and sites keep it in their logs. Claude Code doesn’t stamp your address on every request. Claude adds it, sometimes, when it writes a request itself, in a curl command or a script, and decides the site wants a contact.

Others on the issue found the same in their own sessions. One searched their transcripts and found 53 calls that put their address in a User-Agent, across eight sessions from August 9 to November 1, almost all from “workflow subagents writing their own curl -A,” not from Claude Code’s WebFetch tool. Another found that the header named the work as well as the person, as in <project-name>-site-build/1.0 (<account email>), sent to a public geocoding service along with an address to look up.

Who’s affected

Everyone signed in to Claude Code with a Claude account has the address in Claude’s context, on every version since at least July. Whether it leaves depends on the work: the reports involve research and scripts that call public services, such as Wikipedia, the SEC’s EDGAR filings and geocoding APIs, and subagents that write their own requests.

How protected you are depends on your version. Claude Code 2.1.317 and later have a built-in check, and the stable channel, which Homebrew’s claude-code cask follows, is still on 2.1.311, without it, according to npm. Lydia Hallie, who works on Claude Code, wrote: “The stable channel is still on 2.1.311, so update to 2.1.317 or later.”

It’s Claude Code that adds the address, so the same goes for apps that run Claude Code. Enjoy runs the copy of Claude Code installed on your computer, so the same versions and the same fix apply, and it shows a newer version beside Claude Code’s name in the agent settings (Update an agent).

Why Claude puts your address in a request

Two things meet. Claude Code tells the model who you are: a user found in July, in version 2.1.220, that it adds a line beginning “The user’s email address is” with the address from ~/.claude.json. Hallie explained why on Hacker News: “Users had reported Claude would hallucinate names for things like @author tags, since it didn’t have context on the account. So we added the account email in the model’s context for signed-in users.”

And some sites ask scripts for a contact. The Wikimedia Foundation’s User-Agent policy asks for “some way of contacting you, the operator,” which “should be given as an email address, a website, or a wiki user,” and warns that scripts without one “may be blocked without notice.” The SEC’s EDGAR page asks tools to “declare your user agent in request headers,” with the sample Sample Company Name AdminContact@<sample company domain>.com. With an address at hand, Claude sometimes supplies it. As a Claude Code engineer put it: “Claude apparently tends to decide that this policy is worth following.”

Anthropic had already told Claude not to. Claude Code 2.1.234, from August 17, says in the changelog: “Claude is now told to use your account email only to identify you, and not to send it to unrelated services unless you ask.” The model didn’t always follow it.

What Anthropic has changed, and what’s next

Date	Version	What it does about your address
August 17	2.1.234	Tells Claude to use it “only to identify you”
October 26	2.1.311	Today’s stable channel: the instruction, no check
November 3	2.1.317	Adds a built-in privacy check, cc-plugin-privacy, on by default
November 4	2.1.318	Tells Claude a site asking for a contact “is not a reason to use this address,” per Yunus Aydın’s analysis
November 6	2.1.319	Today’s latest; its changelog doesn’t mention the address
“Early next week”	The next release	Takes the address out of Claude’s context, Anthropic says

The check is a stopgap. The changelog describes it as one that “asks before a web or shell tool call sends your account email address to the network,” and Hallie says it “still doesn’t prevent all cases, like when Claude writes a script and runs on its own.” The source Anthropic published that evening is narrower: it refuses, without asking, a shell command that holds your address and names a User-Agent. Its README calls it “a courtesy, not a boundary,” says “WebFetch and WebSearch are not checked, and neither are MCP tools,” and lists “a server-side switch, read once per session” among the things that turn it off. Aydın’s analysis found the check that shipped in 2.1.318 differs from that source: it asks rather than refuses, and it watches WebFetch and WebSearch too. Neither version sees an address a script reads from a file or a variable while it runs.

On the issue, one person on macOS (2.1.317 and 2.1.318) and one on Windows 11 (2.1.318) reported that their test commands ran without a prompt, with the check listed as loaded. Two others said they couldn’t find it at all on 2.1.318.

The fix Anthropic has promised goes further. Hallie, late on November 5: “We’re removing the account email address from the context Claude Code gives the model. This update will hit Claude Code users in the next release, which should arrive early next week.” She added: “this should not have happened, and we should’ve caught this behavior earlier.” As of November 8, that release hasn’t shipped.

How to check whether your address went out

Claude Code saves each session’s messages and tool calls in plaintext JSONL files under ~/.claude/projects/, kept “for 30 days by default,” Anthropic’s docs say. Search them for the address you sign in to Claude with, in place of you@example.com:

grep -rF 'you@example.com' ~/.claude/projects | grep -iE 'user.?agent|mailto:| -A | -U ' | cut -d: -f1 | sort -u

That lists the sessions where your address is on the same line as a User-Agent, a mailto:, curl’s -A or wget’s -U. To list the sites those lines went to:

grep -rF 'you@example.com' ~/.claude/projects | grep -iE 'user.?agent|mailto:| -A | -U ' | grep -oE 'https?://[^/ \\"]+' | sort -u

Read the results with care. A match means Claude wrote your address into a command or a script; whether it was sent depends on whether it ran, which the tool result after it shows. Sessions past your cleanupPeriodDays are gone. And no match isn’t proof that nothing went out: a script that read your address while it ran, from your git config for example, leaves no trace here. One user on the issue says Claude “pulled my email address from my gitconfig.” On Windows, the folder is .claude\projects in your user folder.

What to do until the fix ships

1. Get the check. Run claude --version. If it’s below 2.1.317, switch to the latest channel in /config under Auto-update channel if you’re on stable, then run claude update. With Homebrew, Anthropic’s setup docs say “claude-code tracks stable and claude-code@latest tracks latest.” Then open /plugin and leave cc-plugin-privacy on.
2. Tell Claude. Add a line to ~/.claude/CLAUDE.md, which Anthropic’s docs say applies to all your projects, such as: “Never put my email address in a User-Agent, header, URL or request body. Use a generic client name, and ask me if a site needs a contact.” It’s an instruction, like Anthropic’s own, so it lowers the odds rather than closing the gap.
3. Read network commands before you approve them. Look for your address in a curl -A, a header or a script Claude wants to run. In auto mode, or with a saved rule such as Bash(curl *), matching commands run without asking you first.
4. Choose the contact yourself. When Claude needs Wikipedia or EDGAR, give it the contact to use: a project page, a wiki username or an address you made for the purpose. Wikimedia accepts “a website, or a wiki user.”
5. If your address went out, it stays out. The sites’ logs keep it. Watch for spam and phishing, especially messages that know your projects’ names.

What hasn’t been said

• When the release lands. “Early next week” is all Anthropic has said, with no date or version.
• Whether it ends the problem. Taking the address out of Claude’s context doesn’t stop Claude finding it elsewhere, in your git config or a project’s files, or naming your projects in its User-Agent. Anthropic hasn’t said whether Claude will be told to use a generic one.
• Who was affected, and where. Anthropic hasn’t said how many sessions sent an address or to which sites, or whether it will tell the people affected.
• A statement. Beyond the team’s comments on Hacker News and GitHub, Anthropic hasn’t published one. Issue 107757 and the July issue, 81138, are both still open.