News2 sources33 comments in the community
Claude Code Put Account Emails in User-Agent Headers. Stable 2.1.311 Lacks the Guard
DEV Community: ai · By Gabriel Anhaia ·
Book: Prompt Engineering Pocket Guide The series: Pocket Guides for Developers — 8 short books on agents, RAG, prompts, observability, events, databases and system design — the whole series My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and…
The Brief
- Users report that Claude Code writes the account email into the User-Agent header of web requests, for example "my-session-slug/1 <my.name@example.com>".
- A DEV Community post says stable Claude Code 2.1.311 lacks a guard against putting account emails in User-Agent headers.
- A commenter reports that a system prompt block containing the user's email is the cause, and that Claude does not reliably follow its instruction not to send it to unrelated services.
Why it matters
Claude Code may disclose a developer's account email to third-party websites, which commenters link to spam and phishing aimed at work addresses.
Who’s affected
- Claude Code users
- Teams using Claude Code with work email addresses
What to do
- Check your Claude Code version; a commenter says 2.1.317 or later includes a built-in cc-plugin-privacy check that can be turned off via /plugins
- Claude Code 2.1.311
- Claude Code 2.1.317
- Claude Code 2.1.318
- Codex CLI 0.159.0
- #claude-code
- #privacy
- #user-agent
- #anthropic
- #data-leak
What developers are saying
Based on 33 comments · Mostly critical
Commenters largely see the behaviour as a privacy violation, with some reporting spam and phishing sent to work or project-related addresses. Others say they never saw spam on masked addresses, and a few argue the design makes sense for attribution. Several say they will switch away from Claude Code or are considering it if their organisation bans it.
- Privacy violation concerns40%
- Spam to work email20%
- Hidden system prompt block15%
- Loss of trust in Anthropic15%
- Masked emails unaffected10%
In favour
- + The design may serve attribution, since Anthropic could use the email to identify users for web searches
Concerns
- − The email reaches third-party sites, and some commenters link it to spam and phishing
- − Claude does not reliably follow the system prompt instruction not to send the email to unrelated services
- − Subagent requests also included user names and project repository details in headers
- − Some commenters say their organisation may ban Claude as a result
“This violates the privacy of paying customers and has resulted in me getting dozens of scam and phishing emails per day”
“This is insane, and if the org I work for bans Claude as a result I will not be the least surprised. Goodbye Claude Code.”
“And Claude doesn't care about what the text says and when it uses cURL it will often "by accident" send your mail in the User-Agent.”
Timeline
Full coverage · 2 sources
- 3h ago ↗
DEV Community: ai
Claude Code Put Account Emails in User-Agent Headers. Stable 2.1.311 Lacks the Guard
- 16h ago ↗
Hacker News: Front Page
Claude Code sends your email address to websites
