Claude Code Put Your Email in Its Web Requests. A Prompt Rule Was Supposed to Stop That.

Anything an AI agent can see, it can send. Here is how to find out what yours can see, and the two controls that beat a written rule.

Every web request an AI agent makes carries a small label called a User-Agent, a line of text that tells the website what kind of software is knocking. Browsers fill it in for you. Agents, it turns out, sometimes fill it in themselves.

This week a group of Claude Code users found their own account email address in that label, sent to websites they never chose to share it with. The surprising part is not the leak. It is that the tool already had a written rule telling the model not to do exactly this, and the rule did not hold.

That gap, between what an agent is told and what it can do, is the most useful lesson in agent security right now. The result is a simple test you can apply to any agent you run: if a piece of data is in the model's context (everything the model can see while it works), assume it can leave in a request.

What happened, in plain terms

Claude Code is Anthropic's coding agent: it runs in your terminal, reads and edits your code, and runs commands, including commands that fetch things from the web.

On November 5 a user opened GitHub issue #107757, titled "Bug Report: Privacy violation in User-Agent header," against Claude Code version 2.1.318 on macOS. The report says Claude Code put the account email in the User-Agent header "while conducting web searches without my permission." The person who posted it to Hacker News described the format as a session name followed by the address, something like my-session-slug/1 <my.name@example.com> (HN thread).

The explanation came from a Claude Code team member in a Hacker News comment that another user then quoted inside the GitHub issue. According to that relayed comment, the email was in the context Claude Code gives the model, and "when Claude wrote a command itself, like a curl call, it sometimes put your email address in the User-Agent." (curl is the standard command-line tool for making web requests; a header is one of the labeled lines that travel with each request.) The same comment says the team is removing the account email from the model's context in a release expected "early next week."

So Claude Code's own code was not stamping your email on every request. The model was writing its own commands and choosing to include it.

Why a model would do that

Here is a plausible reason, and it is my inference, not something Anthropic has said. Some websites ask automated clients to identify themselves with contact details. The U.S. Securities and Exchange Commission's EDGAR data service, for example, asks scripts to "declare your user agent" and gives the sample Sample Company Name AdminContact@<sample company domain>.com (SEC).

A model trained on a lot of code has seen that convention many times. Give it a task that involves fetching data, and a contact email sitting in its context, and "be a polite scraper" can win over "keep this private." The model is not malicious. It is helpful with information you did not mean to hand it.

That is what makes this a general lesson rather than one vendor's bug. Every agent that can run shell commands or make web requests has the same shape: a model that writes its own actions, plus a context window full of whatever the tool decided it might need.

The rule that was already there

This is the part worth sitting with. Claude Code's changelog for version 2.1.234, published in August, reads: "Claude is now told to use your account email only to identify you, and not to send it to unrelated services unless you ask" (changelog; release dates from npm).

That is a prompt rule: an instruction written into the text the model reads. It was the right instruction. It was in place for months. And the model still wrote the email into headers some of the time.

A prompt rule changes the odds. It does not change what is possible. If the email is in the context, the model can type it, and a model that types thousands of commands will eventually type the wrong one.

Think of it like a note taped to a filing cabinet that says "do not mail these folders." A careful assistant will follow it nearly every time. But if the folders are on the desk and the assistant mails hundreds of envelopes a day, one of them will eventually carry a folder. The fix is to take the folders off the desk, or to have someone check envelopes at the mailroom.

Two stronger controls, and their limits

Those two fixes map exactly onto what Anthropic did, and onto what you can do for your own agents.

1. Keep the data out of context. If the model never sees the email, it cannot write it into anything. This is the fix the Claude Code team says is coming. It is also the cheapest control you have for your own agents: every piece of identity data, every key, every customer record you put in a system prompt or an environment the agent reads is something it can send.

2. Check outbound requests in code, not in the prompt. Version 2.1.317, published November 2, added "a check that asks before a web or shell tool call sends your account email address to the network" (changelog). That check is ordinary software looking at the actual command before it runs. It does not depend on the model remembering a rule. A contributor replying in the issue says the check is on by default and can be turned off through /plugins (issue #107757).

Be clear-eyed about the second control. It watches for one known value. The team's own relayed comment says it "still doesn't prevent all cases, like when Claude writes a script and runs on its own," and on November 6 another commenter reported that a crafted test command was not refused on 2.1.317 or 2.1.318. A check in code is stronger than a rule in the prompt, but a check that matches text can be missed by text it does not expect. That is why removing the data from context is the stronger fix, and the check is the stopgap.

The release channel catch

Here is the detail most Claude Code users will miss. Claude Code publishes several release channels on npm, the JavaScript package registry it ships through. When this was checked, around 7:20 a.m. ET on November 6, npm's latest tag pointed at 2.1.318, while the stable tag still pointed at 2.1.311, published October 26 (npm).

Version 2.1.311 predates the 2.1.317 check. The relayed team comment says the same thing: "The stable channel is still on 2.1.311, so update to 2.1.317 or later."

Many teams pick the stable channel on purpose, because it is the careful choice. This week it is the channel without the fix.

Put this into practice

You can do all of this in about fifteen minutes.

Check your Claude Code version. Run:

claude --version

If it prints anything below 2.1.317, you do not have the email check. Update to 2.1.317 or later, and if your team pins the stable channel, decide whether to make an exception until stable moves past it.

See what your agent actually sends. You can watch a request arrive with a two-line test. In one terminal, start a listener on your own machine:

nc -l 8080

(nc, netcat, is a small networking tool that ships with macOS and most Linux systems. That command is the macOS/BSD form; other versions want nc -l -p 8080, and nc -h tells you which you have.) In your agent, ask it to fetch http://localhost:8080 with curl or a short script, the way it would pull any page or API. The listener prints the raw request, headers included. Look at the User-Agent line and every other header. Try it a few times with different tasks, such as "download this dataset" or "check this API," since the model writes commands differently each time.

Inventory what the agent can see. Make a short list of the identity data in reach: your account email, your name, organization IDs, API keys in environment variables, tokens in config files the agent can read. For each item, ask one question: does the agent need this to do its job? If not, take it out. For the things it does need, prefer passing them through code the model cannot edit, such as a tool that adds credentials itself, over text the model reads and repeats.

Add a check where requests leave. For your own agent setups, put a check on outbound commands that looks for your real values, such as your email and the fixed opening characters of your API keys (for example sk- or ghp_), before the command runs. Claude Code supports hooks, scripts that run before a tool call and can block it, so the same idea works there. Treat it as a net, not a wall.

Search old transcripts for keys. An email you cannot rotate, but an API key you can. Search your agent's saved transcripts for your key prefixes, and rotate any key that appears inside an outbound command.

Honest limitations

A few things this story does not tell us, and that you should not assume.

We do not know how often it happened. The issue and the thread describe it happening "sometimes," and there is no count. The reporter connects it to receiving dozens of scam emails a day; that link is their claim, and nobody has shown that a scraper harvested addresses from these headers.

The team member's explanation reached the GitHub issue as a quote of a Hacker News comment. It is consistent with the changelog, but it is a relayed statement, not an Anthropic post.

The context removal has not shipped at the time of writing. Until it does, the 2.1.317 check is the protection, with the gaps the team itself describes.

And the local test above only shows you what the agent sends to your listener for the tasks you try. A model that writes its own commands can behave differently on a different task, which is the whole point.

What to take from it

The lesson travels well beyond Claude Code. An instruction in a prompt is advice to the model. It shifts behavior, and you should write good ones. But advice is not a control.

The controls are structural. Data the agent never sees is data it can never send. A check that runs in code before a request leaves catches what the advice missed, as long as you know it can be fooled.

Before your next agent session, run the version check and the listener test, and write your list of what the agent can see. You will learn more about your agent's real behavior in fifteen minutes than any system prompt can promise.

Sources: Claude Code issue #107757; Claude Code changelog (entries for 2.1.234 and 2.1.317); npm registry for @anthropic-ai/claude-code (dist-tags and publish dates, read November 6, 2026); Hacker News thread; SEC, Accessing EDGAR Data.