@readmodelmag
MODEL
Subscribe

Tools

Claude Code leaked signed-in emails into User-Agent — Anthropic shipped a narrow privacy mod

SummaryClaude Code put the signed-in account email into model context; the model sometimes invented HTTP User-Agent headers with that address on outbound web/shell calls. Anthropic confirmed on HN and shipped built-in cc-plugin-privacy from 2.1.317+ (default on). Mod is a courtesy, not a boundary — WebFetch/WebSearch/MCP unchecked.

· MODEL Editors · 1 min read

Some links may be affiliate links. Disclosure

MODEL news card on a cream background. Small red kicker: SECURITY. Large red figure: UA. Headline: Claude Code put your email in User-Agent. MODEL wordmark bottom left; Source: Anthropic, HN bottom right.
Claude Code privacy mod after User-Agent email reports. Not tested by MODEL. Illustration by MODEL. Original. Image source.

Claude Code put the signed-in account's email into model context. The model sometimes put that address into HTTP User-Agent headers on outbound web/shell calls. Reports spiked on Reddit and Hacker News; Anthropic confirmed and shipped a narrow privacy fix.

What happened. The account address sat in context so Claude would stop hallucinating @author names. Some sites (e.g. Wikipedia) encourage scripted clients to identify themselves with a contact email in User-Agent. Claude sometimes invented a User-Agent that included the account email — not every request, and not a stamped-on-every-call agent header. Users self-reported spam after the exposure; spam causation is unproven.

What Anthropic shipped. Anthropic staff mpoteat on HN: built-in mod cc-plugin-privacy from 2.1.317+, default on; disable via /plugins. Source published Nov 6 in PR #107768 (opens in a new tab) under mods/privacy.

What the mod does. One tool.check hook: refuse Bash / PowerShell / Monitor when the input holds the account address and names a User-Agent (User-Agent, --user-agent, curl -A, wget -U, etc.). Refusal raises no prompt. Saved allow rules and auto-mode classifiers do not clear it.

What it does NOT cover. The README calls it "a courtesy, not a boundary." These still pass: address with no UA named (URL, body, From:, curl -u); WebFetch and WebSearch are not checked; MCP tools not checked; runtime-computed emails; variables; scripts; other clients / encodings.

Who it's for: Claude Code users on or after 2.1.317, anyone who treats agent outbound HTTP as a privacy surface, and founders shipping agents that put identity into model context.

Caveats. Not every request leaked email. Email-in-context was reported as early as July (#81138). This is Anthropic's narrow shell/UA check — not a full PII boundary. MODEL has not tested the mod.

Disclosure: Not sponsored. No affiliate links. Not tested by MODEL.

MODEL Editors

Sources

  1. Anthropic staff (mpoteat) on HN: cc-plugin-privacy from 2.1.317+

    Hacker News

  2. mods: add the privacy mod (PR #107768)

    GitHub / anthropics/claude-code

  3. mods/privacy README

    anthropics/claude-code

  4. Related issue #107757

    GitHub

  5. Older related: email in context (#81138, since July)

    GitHub

Keep reading

FREE · EVERY WEEK

The top AI tools this week, tested.

Every week MODEL's editors pick the AI tools worth your time, try them hands-on, and tell you what's good, what's not, and who it's for. Free, in your inbox.

Free. Unsubscribe anytime. Our picks are editorial and can't be bought.