Claude Code users have reported on GitHub since July that the coding agent put their account email address into the User-Agent header of web requests it made to outside sites. Anthropic’s version 2.1.317, published on 2 November, “Added a check that asks before a web or shell tool call sends your account email address to the network”, according to the Claude Code changelog.
That check came 108 days after the earliest such report we found, issue #78431 of 17 July, by our arithmetic. A report opened on 5 November, issue #107757, reached 1,210 points and 382 comments on Hacker News by about 11:40 UTC on 6 November.
Business Pill · AI Agents Explained
A short explainer on how AI agents move from answering to doing, by calling tools. It teaches the general idea only and does not discuss this story.
The key insight: As we read it, the fix moved from the model to the harness: version 2.1.234 told the model not to send the account email, and reports kept arriving on later versions; version 2.1.317 added a check on the tool call itself, 108 days after the first report we found, by our arithmetic.
The reports describe the model itself writing the address into commands, not a fixed header. Issue #104774, opened on 24 October on version 2.1.310, says three subagents sent 9 requests to sec.gov with the email in the User-Agent. The example it gives is a curl command whose -A option, which sets the User-Agent, carried a research label followed by the address.
Issue #95258, opened on 18 September on version 2.1.275, quotes the agent’s own explanation that the address came from “a system block labeled userEmail” and that it was put “in the User-Agent header of a curl request to crates.io’s public API”.
Issue #102577, opened on 15 October on version 2.1.300, quotes the agent saying “Wikipedia got it in four search requests”. An earlier issue, #81138 of 25 July, objects that the “Account email (PII) is injected into the model’s system prompt”.
Days after the earliest GitHub report we found (issue #78431, 17 July 2026) of Claude Code putting a user’s account email in a User-Agent header, to each change: the model instruction in version 2.1.234 (npm, 17 August), the check in version 2.1.317 (npm, 2 November) and pull request #107768 publishing the privacy mod’s source (6 November). Source: Claude Code changelog, npm registry, GitHub. Day counts are our arithmetic.
Why a Site Would Get an Email
Some sites ask automated tools to identify themselves with contact details. The SEC’s EDGAR access page says “Please declare your user agent in request headers”; its sample header pairs a company name with an admin contact email address.
The Wikimedia Foundation’s User-Agent policy says “Scripts should use an informative User-Agent string with contact information, or they may be blocked without notice”. The author of issue #104774 called the SEC requirement “The likely trigger” in that case.
What Changed, Version by Version
Version 2.1.234, published on npm on 17 August, 31 days after the first report, changed the instructions: “Claude is now told to use your account email only to identify you, and not to send it to unrelated services unless you ask”, the changelog says.
Reports kept arriving after that, on versions 2.1.275, 2.1.300 and 2.1.310. Issue #104774 asked for “a harness-level guard, e.g. block tool calls containing the user’s email by default, rather than relying on model compliance alone”.
Version 2.1.317 added the check on 2 November, 77 days after the instruction change, by our arithmetic. On 6 November pull request #107768 published the source of a built-in “privacy” mod that “refuses a shell call holding the signed-in account’s email address and naming a User-Agent”.
The check has its own complaints. Issue #107144, opened on 4 November, says it “denies local-only Bash calls in headless bypass runs”.
What Users Say Happened Next
The author of issue #107757, on version 2.1.318, wrote: “I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties”. Three of the issue’s 67 comments, by three different users, mention spam, scams or phishing, by our count. These are user reports; we have not verified them, and none shows which site, if any, passed an address on.
As we read the issue texts, the address was not a fixed header that every request carried; the reports describe the agent writing it into individual commands, in one case to sec.gov, whose access page asks automated tools to declare a user agent with contact details.
As we read the version history, an instruction in the prompt and a check on the call are different kinds of control: the first relies on the model following it, the second inspects what the call contains before it runs, as the 2.1.317 changelog line describes.
As we read issue #107144, the new check also stops some calls that stay on the machine, so the control has a cost in false stops for headless users.
Issue #104774, opened 24 October 2026, on what the reporter asked Anthropic to build
“a harness-level guard, e.g. block tool calls containing the user’s email by default, rather than relying on model compliance alone”
Three Implications
FOR CLAUDE CODE USERS Version 2.1.317 or later asks before a web or shell call sends the account email, the changelog says; earlier versions relied on the model instruction added in 2.1.234.
FOR SITES THAT LOG USER AGENTS The SEC and Wikimedia pages ask automated tools for contact details in the User-Agent, so their logs are where such addresses would land.
FOR ANTHROPIC Issue #107757 had 67 comments and its Hacker News thread 1,210 points by about 11:40 UTC on 6 November, with no comment we found from an account GitHub marks as an Anthropic member.
The framework says: “The surface, not the model, governs autonomy.”
As we read it, this episode shows the same split for control: the instruction lived in the model’s context, while the check that now asks before the email leaves lives in the harness. The framework does not discuss this bug, user agents or account emails.
What Is Not Established
We do not know how many users or requests were affected, which sites received addresses, or whether any spam reported by users came from these requests. We found no comment from an account GitHub marks as an Anthropic member or collaborator on issues #107757, #95258, #81138 or #107144, and no post on the issue from the Anthropic, Claude or ClaudeDevs X accounts we searched, as of about 11:40 UTC on 6 November. We did not contact Anthropic.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
GitHub issues since 17 July report Claude Code putting users’ account emails into User-Agent headers sent to sites such as sec.gov, crates.io and Wikipedia. An instruction to the model followed at day 31; a check on outgoing calls, in version 2.1.317, at day 108, by our arithmetic.
A note on sourcing. We read the Claude Code changelog, npm publish times for versions 2.1.234, 2.1.317 and 2.1.318, GitHub issues #78431, #81138, #95258, #101659, #102577, #104774, #107144 and #107757 and pull request #107768 through the GitHub API, the Hacker News thread figures, and the SEC and Wikimedia User-Agent pages, on 6 November 2026 between 11:30 and 11:45 UTC. Statements in issues are users’ reports; we have not verified them.
Day counts are our arithmetic. An X story summary written by Grok pointed us to the story; we did not use it as a source. We did not contact Anthropic.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
