On 5 November, a Claude Code user opened a bug report titled “Privacy violation in User-Agent header”. While doing web searches, the agent had sent their email address to third-party websites inside the HTTP User-Agent header. They were on version 2.1.318, and they asked for the behavior to be removed entirely, not made optional.
The details are still being worked out, and a fix is on the way. But the way it happened is worth understanding, because it is not really a Claude Code bug. It is something any coding agent can do with whatever sits in its context.
What seems to have happened
The explanation quoted in the thread is simple. The agent had the user's account email in its context. When it wrote a request to fetch a web page, it followed a common convention for well-behaved bots: put a contact address in the User-Agent. The address it had to hand was the user's.
No one told it to leak anything. It was being polite with information it had been given for another purpose. That is the uncomfortable part: a model does not keep a mental list of which facts are private. Whatever is in its context is material it may use, including in requests to servers you don't control.
Cyber Security News notes what the public evidence does not show. The issue includes no raw request or exact header, it is not clear which kinds of requests were affected, and nothing proves the leak caused the scam emails the reporter mentions or that it affects every user.
The response so far
- A contributor in the thread says versions 2.1.317 and later include a built-in module,
cc-plugin-privacy, that is meant to block this and is on by default. - Another user reports that on 2.1.317 and 2.1.318, a test command with the account email in a
User-Agentstring was not blocked even with the module enabled. - A comment quoted from Hacker News, attributed to someone who works on Claude Code, says the account email is being removed from the model's context in an upcoming release, and that until then newer versions ask before web calls or curl-style commands that contain it, which does not catch every case.
The issue was still open at the time of writing. If you use Claude Code, update, and watch for the release that takes the email out of context.
The general lesson: context is an outbound channel
We usually think about what goes into an agent's context: instructions, code, docs. This incident is a reminder to think about what can come out. Every fetch, curl command, API call, MCP request or comment the agent writes can carry text from its context to somewhere else. Most of the time that is the point. Sometimes it is a leak.
Things that commonly sit in an agent's context without anyone choosing to put them there:
- your name, email and machine username, from the tool, git config or the shell;
- internal hostnames, ticket links and customer names from logs, issues and docs;
- environment variables and config files the agent read while debugging;
- tokens pasted into a prompt “just this once”.
What to change on your team
- Keep secrets out of reach, not just out of prompts. If a token is in a file the agent can read, it can end up in its context. Use a secrets manager and short-lived credentials, and keep
.envfiles out of the agent's working directory where you can. - Require approval for network calls. Most agents can ask before running
curl,wgetor web fetches. That one prompt is where you would have seen an email in a header. - Read what goes out, not only what comes back. When you approve a request, glance at the headers and body. A personal detail in a request to a third party is a red flag even when the request itself is fine.
- Restrict egress for unattended runs. Agents running in CI or background sandboxes rarely need the open internet. An allowlist of package registries and your own APIs removes most of the risk.
- Use hooks for the obvious patterns. A pre-tool hook that refuses commands containing your company's email domain or known token prefixes is a few lines and catches the simple cases.
The takeaway
Nothing malicious happened here. An agent tried to be a polite web citizen with the wrong piece of information. That is exactly why it matters: as agents make more requests on our behalf, the question is no longer only what they can reach, but what they carry with them when they do. Treat the context window as data that can leave your machine, and set your defaults accordingly.
Sources: anthropics/claude-code issue #107757 (opened 5 November 2026), Cyber Security News (6 November 2026).