Image: Anthropic
Anthropic has acknowledged that Claude Code sometimes included users' account email addresses in requests to outside websites without asking. A privacy safeguard is available, but an engineer says it does not cover every route. Removing the account email from the information given to the model is still an announced change, not a verified shipped fix.
The latest public issue, number 107757 on Anthropic's GitHub repository, remains open at the time of this writing. Its author reports using Claude Code 2.1.318 on macOS and blames the disclosure for dozens of daily scam emails. Other commenters describe similar spam increases, but the reports do not establish where scammers obtained those addresses.
The disclosure happened through a User Agent header, a label that software sends when requesting a web page. Websites can read and log that label. An email placed there reaches the receiving site even if the user never fills in a form. Encryption protects the request during transit, but does not hide its contents from the destination.
This was not an automatic email attachment on every Claude Code request. Lydia Hallie, posting as lydia_hallie on Hacker News and identifying herself as a Claude Code engineer, said the model sometimes inserted the address when writing its own commands, such as requests made with curl, a command line download tool.
Hallie explained that Anthropic added the account email to the model's context to stop it inventing names for author tags in code. Context is the information the model receives before answering or acting. Some websites ask automated clients for contact details, and Claude sometimes reused the address it could see.
Hallie apologized and said the team was removing the account email from model context. She expected that change in a release early next week. That remains a forecast rather than a confirmed delivery date.
Version checks show a newer release than some early coverage describes. The npm registry lists 2.1.319 as latest, matching GitHub's newest release. However, npm's stable tag still points to 2.1.311. The public changelog through 2.1.319 does not announce removal of the email from model context.
Versions 2.1.317 and later include cc-plugin-privacy, a safeguard Anthropic says is enabled by default. The 2.1.317 release notes describe a check that asks before web or shell calls send the account email. Hallie's explanation also describes permission prompts, while acknowledging gaps when Claude writes and runs a script.
The published privacy module README is narrower. It says matching Bash, PowerShell and Monitor calls are refused without a prompt when their input contains both the account email and a User Agent reference. It explicitly excludes WebFetch, WebSearch, MCP tools, scripts containing the address and values calculated while a command runs. The document calls the safeguard a courtesy rather than a security boundary.
Users have reported failed checks on macOS and Windows with 2.1.317 and 2.1.318. A later GitHub comment reports similar behavior on macOS with 2.1.319. These are user tests, not independently reproduced results, but they reinforce why installing the safeguard should not be treated as complete protection.
The immediate advice is to check the installed version with claude --version, update to 2.1.317 or newer and leave cc-plugin-privacy enabled in /plugins. With 2.1.319 available, users should verify what their update channel actually installed rather than assume a stable installation has the safeguard.
Tin Computer's analysis also recommends reviewing outgoing commands and the scripts they run before permitting network access. If a website requires contact information, choose an approved public contact address or page instead of letting the model select a private login address. Those precautions reduce exposure while users wait for the promised context change, but they do not establish that every possible disclosure route is blocked.
Email leak stopgap in Claude Code checks only shell calls
— The Tradesman November 7, 2026
Anthropic says a Claude Code release expected early next week removes your account email from the model's context; the model sometimes pasted that email into User-Agent headers. Anyone pinned to the npm stable channel was on 2.1.311 as of November 6, with the email in context and no built-in check.
The stopgap in 2.1.317 and later, a mod called cc-plugin-privacy, refuses only Bash, PowerShell and Monitor calls that hold your address and name a User-Agent. Web tools, MCP tools and scripts written to disk pass, and some users report it didn't fire on 2.1.317 and 2.1.318.
Until the fix ships, the explainer offers a scan of past sessions and a PreToolUse hook that blocks any call holding your address.
Comments