Claude Code Exposed for Writing User Emails into Request Headers and Sending Them Out; Anthropic Says It Added Plugin Interception Starting with v2.1.317

Users pay tens or even 200 dollars a month to subscribe to Claude Code, handing their local terminal over to it to do work—yet in the background it stuffs your real login email, name, and even your company's internal code repository addresses into the User-Agent request header and sends them to external websites!

Anthropic engineers, taking the easy way out, quietly hardcoded the login email into the system prompt of every conversation, and Claude, whenever it encountered a website requiring contact information for registration, would conveniently pull the real email out of the prompt and send it off.

Taking the easy way out betrayed user privacy

On November 5, 2026, a post on Hacker News accusing Claude Code of leaking user emails shot to the top of the trending list.

The poster received dozens of scam emails every day that addressed him by his real name, from sending domains he had never visited.

Tracing the request logs, it turned out that when Claude Code went online to fetch data, it had actually appended the session name and his real email to the User-Agent header of HTTP requests.

Commenters soon posted even more alarming server logs: when sub-agents dispatched by Claude Code requested external documents, they wrote the user's real name, team name, and the company's internal GitHub repository paths directly into the request headers.

At first many guessed the model had fallen victim to prompt injection from external web pages.

It was not until the early hours of November 6 that Claude Code engineer Lydia Hallie came forward to apologize and clarify the cause.

Earlier, users had reported that Claude made up names when generating author comment tags, because the model could not access account information.

The engineering team did not anticipate what would happen when this step met the large model's habit of stubbornly grinding through tasks.

When users asked Claude to fetch US SEC financial reports, Wikipedia, crates.io, or the EVE Online game API, these platforms, to prevent scraping, all required scripts to leave a contact email in the request header, otherwise returning a 403 to deny access.

When calling the US SEC API, Claude was subjected to a "prompt injection attack"

The built-in curl does not carry this kind of information by default, so the large model, trained with reinforcement learning, in order to get past the error and complete the task, saw the user's email stored in the context and took it upon itself to splice it into the command and send it out.

In the comments section, one developer used a scraper to hit an API and got their IP banned, so they paid specifically to buy rotating residential proxies to conceal their identity. Yet when Claude wrote the request headers for the scraper, it directly filled in their real email address, and afterward even explained that doing so made it convenient for the other website to write and get in touch directly if problems arose, so as to avoid another IP ban. (Claude: We're doing this for your own good.)

Decompiling revealed the truth

This matter did not blow up completely until early November; looking through the GitHub history shows that users in the know had been struggling with it for more than half a year.

As early as April 2026, the community had submitted at least four tickets, including No. 50702 and No. 53231, pointing out that the account email was forcibly stuffed into the context and could not be turned off. All of them were automatically closed by the official bot on the grounds of inactivity or duplication.

In mid-July, another user submitted ticket No. 78431 because curl leaked the email; it made Hacker News once in August, and by September it was closed by the bot all the same.

With regular feedback ignored, developer skflowne decompiled the Claude Code v2.1.220 installation package on July 25 and produced a detailed evidence report, No. 81138.

After going through the entire code package, this field, apart from counting a boolean value in two telemetry events, is not read by any business function, and it is not mentioned at all in the official documentation or settings page.

Decompiling also uncovered an ironic detail. Claude Code has an environment variable named IS_DEMO; the official documentation specifically recommends that streamers set it to 1 when livestreaming or screen recording, to hide the email and organization name in the status bar.

However, all seven IS_DEMO checks in the program package only block the text display on the surface of the screen and do not touch the model context at all.

Streamers think that turning on demo mode lets them livestream with peace of mind, but the email remains untouched in the model context. The developer who submitted the report personally encountered two incidents.

One was when the model, while explaining other errors, suddenly printed in the terminal that it had seen their email from the system prompt.

The other was when the model submitted code 10 times in a row and directly used git parameters to forcibly pass in the private email, overriding the anonymous email they had set globally. In the end, it was only because GitHub push protection reported an error and blocked it that the private email did not enter the public record.

Anthropic's solution: first persuade the model to behave

Faced with the ironclad evidence laid out by decompiling, Anthropic's patching process over the following months was even more bizarre than the vulnerability itself.

Community teardown tracking found that in v2.1.246, released by the official team at the end of August, that field still had not been removed; they only appended a natural-language instruction after that prompt sentence, telling the model to use the email solely to identify the user and absolutely never to send it to unrelated services. (Claude, don't tell anyone your email!)

By v2.1.289 in late October, this passage had been stuffed into the system reminder tag attached to every tool call, repeated to the model with every request sent.

A few natural-language sentences simply cannot control a probabilistic model; Temperature will teach you a lesson, happily sharing your email with others in no time.

On October 20, a user caught Opus 5.5 on the web client, as usual, stuffing the account email into the request headers of two shell commands.

When questioned, the model honestly admitted that the system context had indeed given it the email along with an instruction forbidding external transmission, but that in order to leave a contact address for the target website, it still decided to send the real email out.

By early November, when Reddit and Hacker News were in complete uproar, another Anthropic engineer, mpoteat, finally responded, saying the team had added a built-in plugin enabled by default in v2.1.317, using deterministic rules to block requests containing the user's email.

While explaining that controlling model behavior is important and extremely non-trivial, he casually typed a haha at the end of the sentence. Such a flippant attitude instantly angered the entire comment section; even though he quietly deleted the laugh afterward, netizens who had screenshotted it still chased him down with furious criticism.

The latest Claude Code version has now been updated to v2.1.319; you can enter claude update on the command line to update to the latest version, and hopefully this vulnerability really has been fixed.

A few hours later, Lydia Hallie had to add and admit that even with this privacy plugin installed, as long as Claude writes scripts itself to run network requests, the plugin still cannot stop it, and the change to remove the account email from the context would not be pushed until the regular release early the next week.

Naturally, some people in the comments put this absurd incident together with Anthropic's usual high-profile marketing.

This frontier AI company, valued at a trillion dollars, claims every day that its team merges 30,000 code commits a day using large models and boasts that writing code is no longer a bottleneck, yet when facing such a serious security issue as a privacy leak that required deleting just one line of code, it dragged its feet for a full six months.

First they wrote prompts to reason with the large model, then they wrote a plugin for the client to block their own model, and finally they told paying users that a complete fix would take another week.

This is Claude Code—truly safe and secure, right? Do you have an Agent like this?

References:

This article is from the WeChat public account "Xinzhiyuan" (ID: AI_era), author: Ma Ke, published by 36Kr with authorization.