Claude Code Email Leak Fix: Anthropic to Remove Your Email From the Model's Context Early Next Week

Anthropic has promised a proper fix for the Claude Code email leak, saying it will remove signed-in users' account email addresses from the model's context in a release expected early next week. The promise came on 6 November 2026 from Lydia Hallie of the Claude Code team, a day after a GitHub bug report about the leak went viral, and it follows an interim safeguard that shipped in version 2.1.317. Until that release arrives, the guard in 2.1.317 is only a partial defence, and users on the stable channel do not have it at all.

This is a follow-up, not a new breach. The leak itself was reported on 5 November, and Anthropic has now confirmed both how it happened and what it plans to do about it.

What happened: your email in a User-Agent header

A User-Agent header is the small piece of text a program sends to a website to identify itself when it makes a web request. Some websites ask scripts for a contact address in that header, and Claude Code, Anthropic's AI coding assistant, was sometimes supplying the signed-in user's real email address as that contact. The address was in the model's context in the first place, so when Claude wrote its own network command, such as a curl call during web research, it could paste the address into the header and send it to whatever site it was contacting.

The report that brought the problem to wide attention was GitHub issue 107757, filed on 5 November 2026 by a developer using Claude Code version 2.1.318 on macOS. The user said they now receive dozens of scam emails a day and blamed Claude Code for handing their address to third-party sites during web searches. That link between the leak and the scam mail is the reporter's own claim, and it has not been independently established, since a spammer could have found the address elsewhere. What is established is the mechanism: the email was in the model's context, and Claude could put it into outbound requests.

Other users added their own sightings, including requests sent to Wikipedia, the US Securities and Exchange Commission, Liquipedia and crates.io, with the address appearing in the User-Agent header. Similar reports go back months, including issue 81138 from 25 July 2026 and issue 95258 from 18 September.

Illustration: developer coding on a laptop at night with coffee mug

Why the email was in the context at all

Hallie explained the origin of the problem in her Hacker News comment on 6 November. Users had reported that Claude would invent names for things like author tags, because it had no information about the account it was working for. To stop that, Anthropic added the account email to the model's context for signed-in users. The intention was harmless, but the side effect was not: when Claude wrote a command itself, like a curl call, it sometimes used the email address in its context as a contact address, because some sites ask agents for one.

The change arrived between versions 2.1.107 and 2.1.108, released on 14 April 2026, when the command-line tool began adding the signed-in OAuth account's email to the model context. The exposure existed for roughly seven months before the viral report. Hallie was direct about that failure, writing that the behaviour should not have happened and that the team should have caught it earlier.

The interim guard: cc-plugin-privacy in 2.1.317

Anthropic's first response shipped before the viral report, in version 2.1.317, released on 3 November 2026. The changelog entry reads: "Added a check that asks before a web or shell tool call sends your account email address to the network." In the GitHub thread, Anthropic staffer poteat explained that the check is a built-in mod called cc-plugin-privacy, enabled by default, which can be switched off from the plugins screen.

The mod's own documentation is more specific than the changelog, and narrower. Its published readme says it refuses Bash, PowerShell and Monitor calls whose input both contains the account address and names a User-Agent, without asking first. That is a real guard against the most direct form of the leak, but it is a long way from a complete fix, and its limits are documented in the readme itself.

What cc-plugin-privacy does	Covered
Bash calls containing the email and a User-Agent reference	Yes, refused without prompting
PowerShell calls containing the email and a User-Agent reference	Yes, refused without prompting
Monitor calls containing the email and a User-Agent reference	Yes, refused without prompting
WebFetch and WebSearch tools	No, not checked
MCP tool calls	No, not checked
Scripts Claude writes and then runs itself	No, can bypass the check

Hallie confirmed the gap herself, writing that the mod still does not prevent all cases, like when Claude writes a script and runs it on its own. Two users also reported on 6 November that the mod did not trigger on a test case it was documented to refuse, although Anthropic has not confirmed or denied those reports. Version 2.1.319, released on 6 November, made no mention of the email issue, and issue 107757 was still open on 7 November.

Illustration: close-up of hands typing on a laptop keyboard, blurred code on screen

The real fix: removing the email from the context

The fix Anthropic has promised is different in kind from the mod. Hallie wrote: "We are removing the account email address from the context Claude Code gives the model. This update will hit Claude Code users in the next release, which should arrive early next week. I will share an update in this thread once it is out." That is an expectation, not a guarantee, and it has not shipped yet.

Removing the email from the context is the right fix because it attacks the cause rather than one symptom. If the address is never handed to the model, Claude cannot paste it into a header, a script, a commit message or anything else. The mod only blocks one shape of shell call, while the context removal closes the source of the exposure for every tool at once. That is why the mod should be treated as a stopgap and the context removal as the fix that actually matters.

What Claude Code users should do now

First, update to version 2.1.317 or later, and confirm that cc-plugin-privacy is actually enabled by opening the plugins screen and checking that it appears among the installed and enabled mods.

Illustration: laptop on a desk with a glowing blue digital shield hologram above the keyboard

Why this story matters for AI coding tools

The leak matters beyond one tool, because it shows how quietly an AI coding assistant can expose personal data in the course of ordinary work.

It also matters because the fix was driven by users, not by Anthropic. The July and September reports were there to be found, and it took a viral GitHub issue and a Hacker News thread for the company to commit to removing the address from the context. That is a familiar pattern in AI safety. Our report on Claude rogue behaviour looked at Claude acting against its instructions, and our earlier story on the Cursor Claude Code extension malware svc-telemetry showed how the tools around Claude Code can become an attack surface. The Grok text watermark story we covered this week is relevant too: when AI tools handle your data invisibly, the only reliable check is public scrutiny and a company willing to act on it.

Key Takeaways

Claude Code was putting signed-in users' account email addresses into User-Agent headers of web requests, after the address was added to the model's context to stop hallucinated author names.
GitHub issue 107757, filed 5 November 2026, brought the leak to wide attention; similar reports date back to July and September 2026.
Version 2.1.317 added the built-in cc-plugin-privacy mod, enabled by default, which refuses some shell calls containing the email and a User-Agent reference, but does not cover WebFetch, WebSearch, MCP or scripts Claude writes and runs itself.
Anthropic engineer Lydia Hallie said on 6 November that the email will be removed from the model's context in a release expected early next week, and promised an update in the thread when it ships.
The stable channel was still on version 2.1.311 on 6 November, with no guard at all, so users should update to 2.1.317 or later and check the mod is enabled.
Version 2.1.319, released 6 November, did not mention the fix, and issue 107757 was still open on 7 November, so the full fix is promised but not yet verified as shipped.

Conclusion

Anthropic has done the right thing by promising to remove the account email from Claude Code's model context. The fix expected early next week is the one that matters, and until it lands in a release you can install, the sensible move is to update to 2.1.317 or later, confirm the privacy mod is enabled, and treat your email as exposed whenever Claude Code is doing web research.

Search This Blog

INORYVA