Users of Anthropic's Claude Code command-line tool discovered this week that the coding agent had been sending their email addresses to websites it visited — tucked into the `User-Agent` header of web requests made during research tasks. The bug, documented in GitHub issue #107757 on November 5, quickly drew hundreds of thousands of views and a rapid response from Anthropic, along with pointed criticism of how the fix was delivered. It is the latest privacy stumble for AI coding agents, a category we watch closely in our AI tools coverage.
"Dozens of Scam Emails Per Day"
The reporter, running Claude Code version 2.1.318 on macOS, wrote that he began receiving "dozens of scam emails per day" after the tool "divulged my email to arbitrary 3rd parties in the `User-Agent` request header while conducting web searches." He argued the behavior should not exist as an opt-in or opt-out setting at all: it does nothing for services that dislike automated traffic, does not preserve user anonymity, and "is a goldmine for scammers." Another commenter independently reported a sudden flood of bizarre spam arriving at an old, typically quiet email address around the same time.
The issue was tagged by Anthropic's maintainers with labels including bug, area:security, and area:tools, and drew dozens of comments within hours of being filed.
How the Leak Happened
In a comment on the issue, an Anthropic contributor explained the mechanism — and stressed that no one had implemented email-sharing deliberately. The scenario, as described: some sites, Wikipedia among them, publish policies asking scripted clients to identify themselves with a contact email in the User-Agent header. When a user asked Claude Code to research a topic on such a site, the model — attempting to comply with that policy — inserted the user's own email address into the header of its `curl` call.
In other words, the model tried to be a well-behaved web citizen and leaked private data in the process. "Models can be highly unpredictable," the contributor wrote. "This is why deterministic checks around model behavior are so important, and why we need to solve alignment."
Anthropic's Fix: A Plugin
Anthropic's response shipped quickly. According to the same comment, a built-in mod called `cc-plugin-privacy` was introduced in version 2.1.317 and later to "deterministically block this behavior." The mod is enabled by default and can be toggled off via the `/plugins` command, and its source has been made available alongside Anthropic's other built-in mods in the Claude Code repository. The company asked users to report any gaps in the checks immediately.
The fix drew two immediate lines of criticism. First, some users questioned the delivery mechanism itself: "Privacy shouldn't be a plugin. It should be an invariant," one commenter wrote, asking what would come next — "cc-plugin-dont-leak-my-API-key?" Second, and more fundamentally, commenters asked why the model has access to the user's email address at all. If the address is never placed into the agent's context, no amount of model misbehavior can leak it. As one user put it, the plugin looks like a band-aid for a design decision that could be removed entirely.
There were also reports of friction with the rollout: one user running version 2.1.318 said he could not find `cc-plugin-privacy` listed in his `/plugins` menu, suggesting the fix had not reached every installation it was meant for. Another commenter noted that a similar report about User-Agent behavior had been filed in the repository as early as July, and criticized the project for acting only once an issue goes viral.
The Bigger Picture for Agent Security
The incident lands at a sensitive moment for Anthropic, which is preparing for a widely reported IPO and positioning its agents for enterprise use. It also lands amid a broader debate about agent harness design: what context an agent is given, what deterministic guardrails wrap around it, and who is accountable when a model improvises.
The core lesson many developers took from the thread is architectural. Modern coding agents act with a degree of autonomy that makes intent-based safeguards — policies the model is told to follow — structurally unreliable. Anything sensitive must be kept out of the model's reach in the first place, with deterministic checks enforcing behavior the model cannot talk its way around. Anthropic's own framing in the issue concedes the point: unpredictable models demand deterministic checks.
For users, the practical guidance is straightforward. If you run Claude Code, update to version 2.1.317 or later and confirm the privacy mod is active. And consider what other context your agent carries — credentials, contact details, internal hostnames — that a well-meaning model might one day decide to share with a stranger.
Stay Ahead of AI
AI tools are shipping faster than their safety reviews can keep up. Follow every development in our AI news coverage.
Read more AI news →
