- Book: Prompt Engineering Pocket Guide
- The series: Pocket Guides for Developers — 8 short books on agents, RAG, prompts, observability, events, databases and system design — the whole series
- My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools
- Me: xgabriel.com | GitHub
On November 5, a Claude Code user opened issue #107757 and said they now get "dozens of scam emails per day." Their explanation: Claude Code put their email address in the User-Agent header of requests it made to third-party sites during web searches.
It wasn't the first report. Issue #101659, opened October 13, describes a research subagent sending the signed-in user's email to Liquipedia inside a curl User-Agent. Issue #102577, opened October 15, says the address went to Wikipedia in four search requests. By the morning of November 6, a Hacker News thread titled "Claude Code sends your email address to websites" had passed 900 points, and a member of the Claude Code team had answered in it. StartupHub.ai covered the report the same day.
Anthropic has shipped a partial guard, and a Claude Code team member says on Hacker News that the email comes out of the model's context in a release expected early next week. As of November 6, the stable release channel doesn't have the guard.
What Claude Code sent, and why
The explanation came from the Claude Code team member on Hacker News. For signed-in users, Claude Code put the account email address into the model's context. It was added because "Users had reported Claude would hallucinate names for things like @author tags." Sometimes Claude then wrote that address into the User-Agent of a curl call, as a contact.
Plenty of sites ask scripted clients to identify themselves. Wikimedia's User-Agent policy warns: "Scripts should use an informative User-Agent string with contact information, or they may be blocked without notice." Its example header includes a contact email address. The SEC's EDGAR access page asks you to declare your user agent and shows a sample header made of a company name and an admin contact email. Liquipedia asks API clients for a contact too, according to the #101659 report.
So the model followed the site's etiquette, and the only contact address it had was yours.
The #101659 reporter adds one more detail. According to the issue, the session context already told the model not to send that email to unrelated services unless the user asked. It sent it anyway, and the site returned a 403.
The address was in the model's context, so a "polite" curl call could carry it to any site that asked for a contact.
What 2.1.317 adds, in its own words
Claude Code 2.1.317, released November 3, lists this change: "Added a check that asks before a web or shell tool call sends your account email address to the network."
On issue #107757, a Claude Code contributor said the check is a built-in mod called cc-plugin-privacy, meant "to deterministically block this behavior." It's on by default, and you can turn it off via /plugins.
Anthropic publishes the mod's source in the claude-code repo, and its README is blunter than the changelog. It describes one tool.check hook. A Bash, PowerShell or Monitor call whose input holds the account address and names a User-Agent is refused. "The refusal raises no prompt, whoever is there and whatever the permission mode." The same README says WebFetch, WebSearch and MCP tools aren't checked, and it describes itself in one line: "This is a courtesy, not a boundary, and it covers one shape."
That README also lists what gets through:
- the address with no User-Agent named, for example in a URL, a request body or a
From:header - a computed value such as
$(git config user.email), a variable, or a script that holds the address - a client the mod doesn't name, any encoding other than one pass of percent-encoding, and a non-ASCII address that's percent-encoded
The changelog says "asks." The published source says it refuses without a prompt and doesn't cover web tools. Those don't match, and I haven't run either build myself. Read the source if you depend on this.
The team member on Hacker News was clear that this is a stopgap: "But it still doesn't prevent all cases, like when Claude writes a script and runs on its own." The real fix is different. "We're removing the account email address from the context Claude Code gives the model," the same comment says, in a release expected early next week.
Reports are still coming in. On November 6, one commenter on #107757 reported that the mod, shown as enabled, didn't refuse a harmless test echo it's documented to refuse, on 2.1.317 and 2.1.318. Another wrote that they were on 2.1.318 with no cc-plugin-privacy and that their logs showed the email going to other domains; they didn't post the logs. Anthropic hadn't responded to either one on the issue when this was written.
The mod refuses one shape: a shell call that holds the address and names a User-Agent.
Stable is still on 2.1.311
This is the part you can act on today. The Hacker News comment says: "The stable channel is still on 2.1.311, so update to 2.1.317 or later."
The setup docs explain the channels. latest is the default and gets releases right away. stable serves "a version that is typically about one week old." The Homebrew claude-code cask tracks stable, and so do the apt, dnf and apk stable repositories. If you picked stable on purpose, you're on a build without the check.
Check your version, then move up. The commands come from the setup docs:
# Which build is running?
claude --version
# On the latest channel: pull the newest build now
claude update
# Native install on stable: install a build with the check
curl -fsSL https://claude.ai/install.sh | bash -s 2.1.317
# Homebrew: the claude-code cask is stable, so switch casks
brew uninstall --cask claude-code
brew install --cask claude-code@latest
claude update won't move a Homebrew install, and brew upgrade claude-code keeps you on the stable cask. On apt, dnf or apk, the channel is set by the repository, so point it at the latest repository URL shown in the setup docs until stable passes 2.1.317.
To stay on stable without sliding back below the fix, add a floor in settings.json. The docs say auto-updates and claude update "refuse to install any version below this value." In managed settings, the same key sets an organization-wide minimum.
{
"autoUpdatesChannel": "stable",
"minimumVersion": "2.1.317"
}
Then check that the mod is actually on: open /plugins, where the contributor on #107757 says it can be switched off, and confirm it's enabled. The mod's README lists several ways it can end up off. One is "cc-plugin-privacy@builtin": false under enabledPlugins in user or managed settings, and an admin can set the managed one for you; a repository's settings can't. Others include /plugin disable, the --settings flag, a server-side switch, and another installed plugin's hook overruling the refusal.
The model can only leak what's in its context
This incident touched three levels of control, and your own setups have the same three. A line in CLAUDE.md or AGENTS.md asks the model to behave. A hook checks the shapes you thought of. Taking the value out of the context window is the only one the model can't get around. Before you paste a customer record or a teammate's address into a session, assume a tool call can carry it somewhere you didn't pick.
Some sites really do need a contact for scripted traffic, and Wikimedia's policy says they can block clients without one. Give your agent an address you're happy to publish, such as a role inbox like bots@example.com, and name it in your project instructions. Then the polite path doesn't need your personal one.
What's in your agent's context right now that you wouldn't want in a request header? Tell me in the comments.
If this was useful
I build Hermes IDE, a free, source-available desktop app that runs Claude Code, Codex and other agents side by side, each in its own real terminal, so it runs whichever claude build you installed and the update above applies there too (GitHub; not affiliated with Anthropic).
This whole incident is a context-engineering lesson: what you put in the window, what an instruction can and can't stop, and where a deterministic check has to take over. The Prompt Engineering Pocket Guide covers those trade-offs for system prompts, project instruction files and tool-using agents. It's one of 8 short books in the Pocket Guides for Developers series, on agents, RAG, prompts, observability, events, databases and system design: the whole series is here.
Top comments (0)