--- title: "Is Claude Code Safe? It Put Some Users' Email in Web Requests" url: https://syntaxradar.com/radar/is-claude-code-safe-email-user-agent author: "Abdul Rehman, Lead Systems Architect and Technical Director" publishedAt: 2026-11-07T00:00:00.000Z dateModified: 2026-11-07T00:00:00.000Z category: "#DEV-SYSTEMS" topic: "is claude code safe" primarySource: https://github.com/anthropics/claude-code/issues/107757 summary: "Is Claude Code safe? It sometimes put users' email in User-Agent headers. Which version adds the check, what is still unfixed, and 3 steps to protect you." --- # Is Claude Code Safe? It Put Some Users' Email in Web Requests **Short answer:** GitHub issue #107757 (opened 2026-11-05) reports Claude Code putting a user's account email in the User-Agent of web requests. Version 2.1.317 adds an ask-first check; an engineer says full removal from model context comes in the next release. **Takeaway:** Update Claude Code to 2.1.317 or later and keep the cc-plugin-privacy mod on, but until the email is removed from the model's context, review any script or network call it writes. **Key figures (as reported by the source):** - First version with the email check: 2.1.317 - Stable channel on 2026-11-06 (engineer's HN comment): 2.1.311 - Thumbs-up on issue #107757: 555 Is Claude Code safe? It is safe enough to keep using if you update, but the problem is not fully fixed. Claude Code sometimes put a signed-in user's account email into the User-Agent header of web requests it wrote itself, such as curl calls. Version 2.1.317 adds a check that asks first. Removing the email from the model's context had not shipped when we last checked the CHANGELOG on 2026-11-06. That is the short answer to the Claude Code privacy concerns that pushed a Hacker News thread to 1,358 points by 2026-11-06. The longer answer matters if you use the tool at work, because the check has a gap that a Claude Code engineer describes, and the email has been in the model's prompt since at least July. ### Is Claude Code safe to use? Claude Code is usable for most work on version 2.1.317 or later, with one known gap. The [Claude Code CHANGELOG](https://raw.githubusercontent.com/anthropics/claude-code/refs/heads/main/CHANGELOG.md) entry for 2.1.317 reads: "Added a check that asks before a web or shell tool call sends your account email address to the network." That check is the main protection in place. The trigger was [GitHub issue #107757](https://github.com/anthropics/claude-code/issues/107757), titled "Bug Report: Privacy violation in User-Agent header". User taylor-edwards opened it on 2026-11-05, running Claude Code 2.1.318 on macOS. They wrote that Claude Code put their email address in the User-Agent header of web-search requests to third parties without permission. The issue is open and labelled area:security and bug. Two points keep the story honest. The reporter says they get dozens of scam emails a day, and one commenter says they were doxxed. Those are claims in the issue, and nothing in it shows the header caused them. Also, 2.1.318 is newer than 2.1.317, so the check was present in the reporter's version. The issue does not say whether it fired. ### Does Claude Code send my email? Yes, in a narrow sense: Claude Code gives your account email to the model, and the model has sometimes copied it into outgoing requests. A Claude Code engineer explained the chain in a [Hacker News comment](https://news.ycombinator.com/item?id=50385272) at 04:24 UTC on 2026-11-06. Users had reported Claude inventing names for things like @author tags in code. To fix that, the account email was added to the model's context for signed-in users. Then, when Claude wrote a command itself, like a curl call, it sometimes put that email in the Claude Code user agent string as a contact address, because some sites ask automated clients for one. A User-Agent header is a short line of text every web request carries to say what software sent it. Some sites, Wikipedia among them, have a policy that scripted clients identify themselves, and HTTP has a standard for putting a contact email there. Claude "tends to decide that this policy is worth following", wrote mpoteat, a GitHub contributor on the project, in the same thread. That is how the email reached ordinary websites: the model was following a convention those sites ask for. None of this was new. [Issue #81138](https://github.com/anthropics/claude-code/issues/81138), opened on 2026-07-25 on version 2.1.220, says the client adds a "# userEmail" block to the system prompt, read from the oauthAccount.emailAddress value in ~/.claude.json. So does Claude Code send data to Anthropic here? Your email travels inside the prompt the model receives. Commenters on that issue reported the behaviour in 2.1.246, 2.1.263 and 2.1.289, and some saw the address in User-Agent headers. ![Text card of the User-Agent header format: a tool name plus a placeholder email, you@example.com](/uploads/blog/is-claude-code-safe-email-user-agent/img1.webp) ### Which Claude Code version fixes the email leak? Version 2.1.317 is the first to carry the check, and no version we checked removes the email itself. Here is the record as of our check on 2026-11-06: - **2.1.317:** adds the ask-before-sending check, according to the CHANGELOG. The changelog lists no dates, so we cannot give a release date. - **2.1.318:** the newest entry in the CHANGELOG on 2026-11-06. None of the entries from 2.1.311 to 2.1.318 mention User-Agent or privacy beyond that one line. - **Full removal:** the engineer's 2026-11-06 Hacker News comment says the team is removing the account email from the context Claude Code gives the model, and that the change lands in the next release. She gave loose timing (early in the following week), not a date. Counting from her 2026-11-06 comment, that points to roughly 2026-11-09 to 2026-11-11, which is our reading and not a stated date. She promised to post in the thread once it is out. That commitment rests on a single secondary source: a comment by a self-identified Claude Code engineer on Hacker News, not an Anthropic release note or blog post. We found no official announcement. As of our check on 2026-11-06 the removal release is not in the CHANGELOG; the file's newest entry shows whether it has shipped since. The same comment adds a detail that matters for teams. The stable channel was still on 2.1.311 at 04:24 UTC on 2026-11-06, which is below the version with the check, according to that comment (single secondary report). She told users to update to 2.1.317 or later and wrote: "this should not have happened". ### SyntaxRadar calculation: how far behind is stable, and how long did this take? We derived these numbers from the issues, the changelog and the two Hacker News threads. Each row shows its inputs.
What we measuredInputsResult
Stable channel vs first version with the check2.1.317 minus 2.1.3116 version numbers behind
Versions between the first report and the new one2.1.318 minus 2.1.22098 version numbers
Time between the two GitHub issues2026-07-25 to 2026-11-05103 days
Attention gap on Hacker News1,358 points vs 42 pointsabout 32.3 times
Share of reactions that were thumbs-up555 of about 73375.7%
Time from Hacker News post to the mod announcement22:17 to 23:26 UTC on 2026-11-0569 minutes
Two readings stand out. First, "6 version numbers" is not 6 releases: the changelog has entries for 2.1.312, 2.1.314, 2.1.316 and 2.1.317 in that span, so anyone on stable at the time of the comment was four changelog entries short of the check. Second, the problem sat in public for months. The [Tell HN post](https://news.ycombinator.com/item?id=50286306) from 2026-10-29 described the same behaviour and drew 42 points. The 2026-11-05 post drew about 32 times as many, and the built-in mod was announced 69 minutes after it went up. mpoteat wrote that the team was "initially aware of this a few days ago when this problem started popping off on Reddit". ![Bar chart of Claude Code versions: stable 2.1.311, email check 2.1.317, reporter's 2.1.318](/uploads/blog/is-claude-code-safe-email-user-agent/img2.webp) ### How do I stop Claude Code leaking my email? You stop most of it by updating and leaving the built-in privacy mod switched on. These three steps use only what a Claude Code engineer, a project contributor and the changelog describe: 1. **Check your version and update to 2.1.317 or later.** If you follow the stable channel, you may still have been on 2.1.311 as of 2026-11-06, per the engineer's comment. 2. **Leave cc-plugin-privacy on.** mpoteat wrote in [issue #107757](https://github.com/anthropics/claude-code/issues/107757) that this built-in mod "deterministically blocks" the behaviour from 2.1.317, is on by default and can be turned off via /plugins. These are the Claude Code privacy settings that matter here, so check it has not been disabled. 3. **Read approval prompts, and watch scripts.** The check asks before a web tool call or curl-style command that contains your email. The engineer wrote that it "still doesn't prevent all cases, like when Claude writes a script and runs on its own". Review scripts before they make network calls. One setting does not help. Issue #81138 notes that IS_DEMO=1 only hides the email in display surfaces; the value still reaches the model. We covered a similar check-and-clean routine in our [Claude Code extension VSCode backdoor guide](/radar/claude-code-extension-vscode-backdoor), which is worth a look if you run Claude Code inside your editor. ### Is Claude Code safe to use at work? It is usable at work once updated, but a check is a weaker guarantee than keeping the email away from the agent. Commenters in the issue made that case on 2026-11-06. marcindulak argued the only way to avoid disclosure is to make the address inaccessible to the agent. randomstuff quoted the mod's description (it blocks "a shell call that holds the account's address and names a User-Agent") and asked whether a different header name would pass. philipwhiuk asked why this is a mod and not core code. These are opinions, but the gap the engineer described supports the first one. The fix order also tells you something. Issue #81138 says an instruction not to send the address to unrelated services was added in 2.1.246, while the value was still injected. A prompt rule asks the model to behave. The 2.1.317 check catches some outputs. Removing the email from context, the promised next step, is the only one of the three that would take the data out of the model's reach, which is the point marcindulak made. Our explainer on [sub-millisecond sandboxes](/radar/sub-millisecond-sandboxes-docker-wasm-micro-vms-untrusted-ai-execution) shows why isolating what an AI agent can touch beats asking it nicely. So, is Claude Code safe for privacy? For a work account, assume the model can see your sign-in email until the removal ships, and review any network call it writes. The same pattern shows up in other AI tools: our piece asking [is ChatGPT safe](/radar/is-chatgpt-safe-three-bugs-private-chats) traces how three small bugs exposed private chats, and our look at a [Postman alternative plugin](/radar/postman-alternative-claude-code-plugin) covers what add-ons put into your Claude Code setup. ### What to watch next The next Claude Code release is the one to watch. The engineer said she would post in the [Hacker News thread](https://news.ycombinator.com/item?id=50385272) once the email is removed from model context, and the CHANGELOG should show a matching line. Also watch whether the stable channel moves past 2.1.317, and whether the cc-plugin-privacy source is published: mpoteat wrote "I'll try to get that built-in mod source available", which is an intention, not a promise. Until then, the honest answer to "is Claude Code safe?" is a qualified yes: update, keep the mod on, and read what it sends. ## Frequently asked questions ### Can I keep using Claude Code at work after the email leak? Yes, for most work, if you run version 2.1.317 or later. That version adds a check that asks before a web or shell tool call sends your account email to the network. A Claude Code engineer says the check does not cover scripts Claude writes and runs on its own, so review those before they make network calls. ### Does Claude Code send data to Anthropic, including my email? According to GitHub issue #81138, the client adds your account email to the system prompt the model receives, read from ~/.claude.json for signed-in users. A Claude Code engineer said on Hacker News on 2026-11-06 that the team is removing it from the model's context in the next release. As of our check on 2026-11-06 that change had not shipped. ### What are the Claude Code privacy settings for this issue? The relevant setting is the built-in cc-plugin-privacy mod. A project contributor wrote that it blocks the email-in-User-Agent behaviour from 2.1.317, is on by default and can be turned off via /plugins. Leave it on. Setting IS_DEMO=1 does not help, because issue #81138 says it only hides the email in display surfaces. ### Did the Claude Code email leak cause spam? That is not established. The reporter of issue #107757 says they receive dozens of scam emails a day, and one commenter says they were doxxed. Those are user claims, and the issue does not show a captured header or prove a link between the User-Agent behaviour and the messages they received. ## Source Based on GitHub issues #107757 and #81138 and the Claude Code CHANGELOG. https://github.com/anthropics/claude-code/issues/107757 --- Published on SyntaxRadar (https://syntaxradar.com). Canonical URL: https://syntaxradar.com/radar/is-claude-code-safe-email-user-agent. Last modified 2026-11-07T00:00:00.000Z.