Claude Code User Email Leak: Anthropic Patch Only Blocks a Single Path

On November 5, 2026, GitHub issue #107757 reached the top of Hacker News, reporting that Claude Code sub-agents, when executing external network requests, wrote the user's login email into the curl User-Agent header and sent it to third-party websites, causing the reporter to receive dozens of spam emails every day.

Factual Reconstruction

The incident originated from the behavior of Claude Code version 2.1.318 on the macOS platform. Without users' knowledge, sub-agents automatically injected email information into request headers when performing web searches. Anthropic introduced the built-in cc-plugin-privacy module in v2.1.317, enabled by default to block this behavior, and users can disable it via /plugins. The module uses hard matching against the specific trigger path in the initial report.

Mechanism Breakdown

The original report pointed out that the leak path was directly related to the logic by which sub-agents perform external I/O. After the patch was released, researchers immediately found eight other semantically equivalent leak paths that could bypass the hard-matching rules. This indicates that the root cause lies in the identity information injection mechanism used by AI agent tools when handling external requests, rather than in a single code path.

The reporter said they received dozens of spam emails every day as a result and decided to migrate the company to Pi with OpenRouter.

Industry Impact

The incident points directly to a privacy boundary design flaw in AI coding tools: broadcasting identity information to third parties without users' knowledge. User feedback shows that similar issues have caused email accounts to receive large amounts of obvious spam. Anthropic's patch was described as a local patch rather than a systemic fix, triggering community discussion about the trustworthiness of AI agent tools.

Strategic Assessment

[Analysis] When tool agents broadcast identity information to third parties without users' knowledge, the question of whether capability or trustworthy behavior matters more has become prominent in the AI coding tool sector. The incident echoes evaluations of AI compliance capability, showing that if privacy protection mechanisms rely only on local patches, they will struggle to cope with semantically equivalent bypass methods. Future tool design needs to re-examine the identity information handling logic of external I/O at the system level in order to rebuild user trust.