# Claude Code sends your account email to websites: agent puts the signed-in address into User-Agent headers · pwn.watch > Claude Code puts the signed-in account's email address into the model's context. When a site asks automated clients for a contact address (crates.io, Wikipedia, Liquipedia, the SEC), the model writing its own curl commands or scripts has put that email into the User-Agent header of outbound requests, sending it to third-party sites without asking. Users reported it from July 2026 on; a Nov 5 2026 GitHub issue blaming the leak for dozens of scam emails a day reached the top of Hacker News. Claude Code 2.1.317 (Nov 3) added a built-in privacy mod, on by default, that asks before a web or shell tool call sends the account email, but Anthropic says it does not catch every case, such as a script Claude writes and runs itself. Anthropic says the next release, expected early in the week of Nov 9, removes the email from the model's context. The stable channel was still on 2.1.311 when Anthropic responded. Page: https://pwn.watch/i/claude-code-account-email-user-agent-leak-nov-2026 · generated 2026-11-07T21:03:56.857Z ## Status - Severity: medium · status: live · patch: partial - Product: Anthropic Claude Code (account email in model context, outbound web and shell requests) - Started: 2026-11-05 - Affected: Claude Code before 2.1.317 (no check); 2.1.317 to 2.1.319 still leak in some cases (scripts, values computed at run time) - Fixed in: 2.1.317 (partial mitigation: privacy mod asks before a tool call sends the account email); full fix (email removed from context) announced for the next release ## Follow this incident - RSS (one item per update): https://pwn.watch/i/claude-code-account-email-user-agent-leak-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/claude-code-account-email-user-agent-leak-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/claude-code-account-email-user-agent-leak-nov-2026.json - This file: https://pwn.watch/i/claude-code-account-email-user-agent-leak-nov-2026/llms.txt ## Updates (newest first) - 2026-11-06: Anthropic's Claude Code team apologizes on Hacker News and says the next release, expected early next week, removes the account email from the model's context; until then, update to 2.1.317 or later. (https://news.ycombinator.com/item?id=50388176) - 2026-11-05: "Privacy violation in User-Agent header" issue: a 2.1.318 user blames the leak for dozens of scam emails a day; the story tops Hacker News. (https://github.com/anthropics/claude-code/issues/107757) - 2026-11-03: Claude Code 2.1.317 adds a check that asks before a web or shell tool call sends the account email address to the network (built-in privacy mod, on by default). (https://github.com/anthropics/claude-code/releases/tag/v2.1.317) - 2026-10-13: A user reports a research subagent sent their email in the User-Agent of a curl request to Liquipedia, which asks API clients for a contact. (https://github.com/anthropics/claude-code/issues/101659) - 2026-07-25: A GitHub issue reports that Claude Code injects the account email into the model's system prompt without consent or disclosure. (https://github.com/anthropics/claude-code/issues/81138) ## Fix brief # Security brief: Claude Code sends your account email to websites: agent puts the signed-in address into User-Agent headers Source: https://pwn.watch/i/claude-code-account-email-user-agent-leak-nov-2026 · status: live · severity: medium · updated Nov 7, 2026, 18:33 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Claude Code puts the signed-in account's email address into the model's context. When a site asks automated clients for a contact address (crates.io, Wikipedia, Liquipedia, the SEC), the model writing its own curl commands or scripts has put that email into the User-Agent header of outbound requests, sending it to third-party sites without asking. Users reported it from July 2026 on; a Nov 5 2026 GitHub issue blaming the leak for dozens of scam emails a day reached the top of Hacker News. Claude Code 2.1.317 (Nov 3) added a built-in privacy mod, on by default, that asks before a web or shell tool call sends the account email, but Anthropic says it does not catch every case, such as a script Claude writes and runs itself. Anthropic says the next release, expected early in the week of Nov 9, removes the email from the model's context. The stable channel was still on 2.1.311 when Anthropic responded. Severity detail: No CVE or score. Privacy leak of the signed-in account email to third-party sites; no credentials or code exposed. Leaks seen mostly in subagents and auto mode. - Product: Anthropic Claude Code (account email in model context, outbound web and shell requests) ## Affected versions - Claude Code before 2.1.317 (no check); 2.1.317 to 2.1.319 still leak in some cases (scripts, values computed at run time) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 2.1.317 (partial mitigation: privacy mod asks before a tool call sends the account email); full fix (email removed from context) announced for the next release After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes If you use Claude Code: update to 2.1.317 or later now (stable is behind on 2.1.311) and keep the built-in privacy mod enabled in /plugins. Read any permission prompt that contains your email and refuse it. Be careful with subagents and auto mode, where most leaks were seen, and when a site needs a contact address, give Claude one to use. Update again when the release that removes the email from context ships. Search your session transcripts under ~/.claude/projects/ for your address to see if it already went out. ## Latest updates - Nov 6, 2026: Anthropic's Claude Code team apologizes on Hacker News and says the next release, expected early next week, removes the account email from the model's context; until then, update to 2.1.317 or later. - Nov 5, 2026: "Privacy violation in User-Agent header" issue: a 2.1.318 user blames the leak for dozens of scam emails a day; the story tops Hacker News. - Nov 3, 2026: Claude Code 2.1.317 adds a check that asks before a web or shell tool call sends the account email address to the network (built-in privacy mod, on by default). - Oct 13, 2026: A user reports a research subagent sent their email in the User-Agent of a curl request to Liquipedia, which asks API clients for a contact. - Jul 25, 2026: A GitHub issue reports that Claude Code injects the account email into the model's system prompt without consent or disclosure. ## Advisories - [Claude Code team statement on removing the account email from model context](https://news.ycombinator.com/item?id=50388176) (Anthropic (Hacker News)) - [Claude Code v2.1.317 release notes](https://github.com/anthropics/claude-code/releases/tag/v2.1.317) (Anthropic) - [Claude Code privacy mod README (what the check covers and misses)](https://github.com/anthropics/claude-code/blob/main/mods/privacy/README.md) (Anthropic) ## Write-ups & news - [Bug Report: Privacy violation in User-Agent header (#107757)](https://github.com/anthropics/claude-code/issues/107757) - [Subagent sent the user's email from session context in a User-Agent header (#101659)](https://github.com/anthropics/claude-code/issues/101659) --- Machine-readable: https://pwn.watch/i/claude-code-account-email-user-agent-leak-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.