A GitHub issue opened on November 5, 2026 in the anthropics/claude-code repository reports that Claude Code put a user’s email address in the User-Agent header of web requests made during searches. The issue, titled “Bug Report: Privacy violation in User-Agent header,” was submitted to Hacker News as “Claude Code sends your email address to websites,” which reached 1,176 points. A repository contributor replied that a built-in privacy mod added in version 2.1.317 blocks the behavior.

What the reporter says

  • The reporter, taylor-edwards, writes: “I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission.”
  • They say the behavior “should not be a setting with opt-out or opt-in behavior, it needs to be removed from the harness entirely,” and that they are migrating their company to another tool.
  • The issue gives version 2.1.318 on macOS in tmux. It is labeled area:security, area:tools, bug and platform:macos, and is open with no assignee.
  • The reporter names no specific tool, such as web search or fetch, and no sites. The issue body includes no logs, request captures or reproduction steps.

The response

A commenter labeled “Contributor,” poteat, wrote on November 5: “We introduced a built-in mod called cc-plugin-privacy to deterministically block this behavior in v2.1.317 and later - definitely let us know ASAP though if there’s a gap in the checks introduced by that mod.” The comment adds that the mod is enabled by default and can be turned off through /plugins, and that the contributor would try to make its source available like other built-in mods. The page does not state the contributor’s affiliation. The reported version, 2.1.318, is later than 2.1.317, and the page does not say whether the reporter tested with the mod enabled. Forty further items sit behind a “Load more” link that Lens did not expand.

Other comments

Other commenters said the same had happened to them. One said it had happened with the SEC, whose EDGAR access guidance asks automated clients to include a contact in the User-Agent header, and another commenter linked that guidance. A commenter reported testing 60 Claude Code runs with a third-party hook: 8 leaked an email without the hook and none with it. That test is the commenter’s own, not Anthropic’s. Some commenters raised GDPR; those are individual opinions, not findings.

Sources and notes

This post is based on GitHub issue #107757 as read on November 6, 2026, and Hacker News counts. The issue had 427 thumbs-up reactions and 26 visible comments. Lens did not run Claude Code, did not capture any requests and did not verify the behavior, the mod or any leaked data. Anthropic makes Claude Code; the contributor’s comment is the only response in the thread that Lens read.

Image: a stack of blank window envelopes on a dark grey surface, by Martin Vorel via Wikimedia Commons, public domain (CC0 dedication); cropped. Stand-in photo; it is not related to the Claude Code story and does not show the events described.