Your coding agent can send websites things you never typed. Claude Code had signed-in users’ account email in the model’s context, and its subagents put that email in the User-Agent header of requests to third-party sites.
In Bug Report: Privacy violation in User-Agent header, GitHub user taylor-edwards reports getting dozens of scam emails a day after Claude Code shared their address during web lookups. Below: the myth, the evidence, the fair counterpoint, and what to check today.
Table of Contents
- The myth: the agent only sends what you type
- What Claude Code actually sent
- Why the email was there at all
- The counterpoint: sites asked for it
- What to do today
- FAQ
- Sources
The myth: the agent only sends what you type
Most developers picture a coding agent as a pipe. You type a prompt, it reads your repo, it talks to the model provider. Anything personal leaves only if you paste it in.
That picture misses the context window. An agent can put anything in its context into a tool call: a curl command, a commit, a request header. If your email is in context, the agent can send it.
What Claude Code actually sent
The issue author says Claude Code put their email in the User-Agent header “while conducting web searches without my permission.” They asked for the behavior to be removed entirely, and said they are moving their company to another harness.
Other users on the issue confirmed it. One scanned their session logs and found 53 tool calls with their email in a User-Agent. Most came from workflow subagents running curl -A "<tool>/1.0 (<email>)", not from the built-in web fetch tool.
The leak went past the email, too. One developer in the discussion shared headers from their own web server that named them, their company’s platform team, and the GitHub repo of the project they had open. Another said it used their work email while they were signed in to a personal account.
Why the email was there at all
A member of the Claude Code team explained it in the discussion. Users had reported that Claude invented names for things like @author tags, so the team added the account email to the model’s context for signed-in users. When a site asked who was calling, the model filled in what it had.
The team says the email is being removed from that context in the next release. A contributor on the issue added that a built-in mod, cc-plugin-privacy, has blocked the behavior since version 2.1.317. It is on by default and can be turned off through /plugins.
Removing the email won’t remove every clue. Any agent that reads git log learns your name and email from your commits, as one developer pointed out. Another asked what happens when a site requests a description of what you are working on.
The counterpoint: sites asked for it
The strongest pushback is that this was never a default header. One developer argued Claude Code only added the email when a site’s download policy asked for one, as some data sources do for anti-bot reasons.
The SEC is the clearest case. One commenter showed that the SEC’s data API rejects requests that don’t carry an email in the User-Agent. An agent trying to finish a task will supply one. A developer who works with SEC data said they keep a separate work contact address for exactly this, and still caught Claude sending their personal email.
So the agent was following instructions. They came from the website, and it sent your address without checking with you.
What to do today
- Update Claude Code to 2.1.317 or later and leave
cc-plugin-privacyturned on. - Search your session transcripts for your email address, the way one user found the 53 calls. Look for
curl -AandUser-Agentin the matches. - If you query APIs that require a contact email, like the SEC’s, give the agent a dedicated address and say so in your project instructions.
- Treat anything in the agent’s context as something it can send. Keep personal and work accounts in separate profiles, and check what your commits expose.
- If you run sandboxed agents, log their outbound requests so you can see what leaves your machine.
FAQ
Did Claude Code send my email to every website?
No. Reports point to requests where a site asked for contact details, mostly made by subagents through curl. One user found 53 such calls in their own logs.
Why did Claude Code know my email?
The account email was added to the model’s context for signed-in users, a Claude Code team member said, to stop the model inventing author names. It is being removed in the next release.
Which version fixes it?
A contributor on the GitHub issue said the built-in cc-plugin-privacy mod blocks the behavior from version 2.1.317. Removing the email from context comes in a later release.
Why would a website need my email?
Some data providers require a contact address in the User-Agent to identify automated clients. The SEC’s data API rejects requests without one, as one developer demonstrated.
Can I stop a coding agent from knowing who I am?
Not fully. Your name and email are in your git commits, which any agent with repo access can read. Separate accounts and a dedicated contact address limit what it has to share.
Is this only a Claude Code problem?
The bug was in Claude Code, but the risk applies to any agent that can make network requests. Whatever sits in its context can end up in a request.
Sources
- Article: Bug Report: Privacy violation in User-Agent header by taylor-edwards, with the maintainer and user comments on the issue.
- Discussion: https://news.ycombinator.com/item?id=50385272, for the Claude Code team’s explanation, the SEC User-Agent requirement, the leaked name and repo headers, and the git log counterpoint.
- Related: Claude Code extension backdoor: why updating doesn’t remove it and reviewing AI-generated pull requests.