---
title: "Claude Code Leaked User Email Addresses in HTTP Request Headers: Anthropic Acknowledges Security Gaps"
description: "Anthropic's Claude Code came under criticism after users discovered personal email addresses leaking via the User-Agent header during web requests. The company has acknowledged security gaps."
date: 2026-11-09T10:16:05.374Z
lang: en
url: https://xab.info/en/posts/claude-code-data-leak-anthropic
tags: [claude-code, anthropic, data-privacy, ai-security, email-leak]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Claude Code Leaked User Email Addresses in HTTP Request Headers: Anthropic Acknowledges Security Gaps

![Young man at a laptop working with the Claude Code utility on screen in an office](https://xab.info/media/2026/11/09/claude-code-utechka-dannyh-anthropic/claude-code-utechka-dannyh-anthropic-1.webp)

## Key Points

- Claude Code version 2.1.318 transmitted user email addresses into the User-Agent header when generating curl requests
- A GitHub user reported dozens of spam emails per day; other participants confirmed similar cases
- The built-in cc-plugin-privacy module failed to prevent the leak, calling its effectiveness into question
- Anthropic plans to completely exclude email addresses from the model context in future releases

On November 5, a public discussion numbered 107757 appeared on GitHub, created by a user with the handle taylor-edwards. In his message, he reported that after starting to work with the AI tool Claude Code version 2.1.318 (macOS environment, tmux terminal multiplexer), he began receiving dozens of unwanted emails daily. According to him, during routine search and web requests, the tool was transmitting private email addresses to third-party sites. The user emphasized that he demands not just a toggle switch in the settings, but a complete elimination of the described behavior at the application architecture level. Although public materials lack raw HTTP headers and step-by-step reproduction instructions, other participants in the ticket comments confirmed similar leakage incidents.

### The Leak Mechanism: Email in the User-Agent Header

The technical core of the issue lies in how Claude Code forms network requests. The User-Agent header in the HTTP protocol is designed to identify the software making a request to a server. However, according to observations by discussion participants, the AI model, while independently generating commands for the curl utility, inserted the user's email address from the work context as a contact identifier. As a result, every request sent to a target website carried a person's real email address in the header. This turned ordinary web access into a channel for unauthorized transmission of personal data to third parties, who could use the acquired information for spam distribution or targeted phishing attacks.

### The Security Module That Failed to Protect

In the ticket comments, users pointed out that newer versions of the platform were supposed to feature a built-in module called cc-plugin-privacy, designed to block such data transmission by default. However, the original complainant was already working on the updated version 2.1.318, and the leak continued. Several participants independently reproduced the scenario and tested the security mechanism: according to their data, cc-plugin-privacy failed to stop the transmission of email addresses in request headers. This called into question the effectiveness of the claimed security and its ability to actually prevent information leakage in typical AI agent workflows.

### Anthropic's Response and Fix Plans

Anthropic representatives responded to the publication, acknowledging gaps in the security system. The company announced that in subsequent releases it will completely exclude account email addresses from the context available to the model. This approach, according to the developers' design, should deprive the AI agent of the ability to insert a real email into generated commands, regardless of what requests it forms. Nevertheless, experts emphasize that until the corresponding update is released, users should independently monitor network commands created by the neural network and not rely solely on basic privacy settings.

### What This Means for Teams and Developers

The Claude Code incident has become a clear example that autonomous AI agents granted the right to form and execute network requests can inadvertently disclose personal data, even if their task is not related to information transfer. Specialists recommend that teams implement an additional layer of audit: logging and checking all curl and HTTP requests generated by AI tools before they are sent. Furthermore, in working environments, it is advisable to restrict the agent's access to user contact data and use pseudonymous identifiers where technically feasible. Until Anthropic releases an update with the complete exclusion of emails from the model context, such measures remain the only reliable way to reduce the risk of leakage.

## Fact-Check & Sources

- [Claude Code сливает личные данные пользователей: Anthropic готовит срочные изменения](https://www.rbc.ua/ukr/news/claude-code-zlivae-osobisti-dani-koristuvachiv-1794215765.html) - The primary source contains a description of GitHub ticket 107757, technical details of the leak via User-Agent, mention of the cc-plugin-privacy module, and Anthropic's response. All key facts of the article rely on this source.

## FAQ

### How exactly did Claude Code transmit user email addresses?

The AI model, independently generating commands for the curl utility, inserted the user's email address from the work context into the User-Agent header of the HTTP request. As a result, every request to a target site carried the sender's real email address.

### Does the cc-plugin-privacy security module work?

According to users who tested the mechanism, cc-plugin-privacy failed to stop the transmission of email addresses in request headers. The original complainant was already using version 2.1.318, and the leak continued.

### What does Anthropic plan to do?

The company stated that in subsequent releases it will completely exclude account email addresses from the context available to the model, which should deprive the agent of the ability to insert an email into generated commands.

### What measures do experts recommend before a fix is released?

Specialists advise teams to log and check all network requests generated by AI tools, restrict the agent's access to user contact details, and use pseudonymous identifiers wherever possible.