If you only saw the headline, here is the actual status as of Saturday morning. What happened:
- Claude Code puts your account email into the model’s context (so Claude does not make up names in @author tags, per Anthropic). When Claude wrote its own curl commands, it sometimes used that email as the contact address in the User-Agent header. So some websites you fetched got your email.
- Bug report #107757 was opened on Nov 5. It is still open, 297 thumbs up as of this morning.
- This is not the first report. A similar issue (#78431) was filed in August. What Anthropic said (Lydia Hallie, Claude Code team, on HN on Nov 6):
- They are removing the account email from the context Claude Code gives the model. That ships in the next regular release, expected early next week.
- 2.1.317 and later have a built-in mod, cc-plugin-privacy, on by default. It asks before a web tool call or a curl style command that contains your email. It does not catch every case, for example scripts Claude runs on its own.
- Quote: “this should not have happened, and we should’ve caught this behavior earlier.” What to check:
- Run
claude --version. The stable channel is still on 2.1.311, which has no guard at all. Latest is 2.1.318. - Update to 2.1.317 or later if you want the mod. Run
/pluginsto see cc-plugin-privacy listed. - One user on the issue says the mod did not block their test on 2.1.317 and 2.1.318, so treat it as a partial fix until the context change lands.
- If you use a unique email per service, now you know which one to rotate. I use Claude Code for a lot of web fetching in research tasks, so this one stings. Are you updating to 2.1.318 now or waiting for next week’s release with the real fix? Source: https://github.com/anthropics/claude-code/issues/107757 submitted by /u/emarkosov
Originally posted by u/emarkosov on r/ClaudeCode
You must log in or # to comment.