Claude Code's Email Fix Checks Shell Flags Only, Its README Says

A user running Claude Code 2.1.318 on macOS filed issue 107757 on Nov. 5, saying the agent put their email address in the User-Agent header of requests to third-party websites. Anthropic's fix, a built-in plugin called cc-plugin-privacy, checks shell commands only, and its own README says it is "a courtesy, not a boundary."

The reporter, who posts as taylor-edwards, wrote: "I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission." The issue names no website and gives no reproduction steps. Several commenters on the thread, which had about 32 comments and more than 172 thumbs-up reactions when we read it, said they had also seen more spam. None of that is evidence of a link; the thread contains no packet capture or request log.

What the contributor said was shipped

A commenter marked as a contributor, poteat, wrote that Anthropic "introduced a built-in mod called cc-plugin-privacy to deterministically block this behavior in v2.1.317 and later", enabled by default and switchable off in /plugins. A second reply, whose author the page did not show, said "nobody implemented this 'share email addresses to websites' as a feature" and that "models can be highly unpredictable."

That is a claim about cause: the model, not the harness code, chose to put the address in the header. One user, francescor, wrote that on 2.1.318, the reporter's own version, cc-plugin-privacy did not appear in /plugins. The thread had no resolution on that point. The issue was still open on Nov. 6 with no assignee, labelled bug, area:security, area:tools and platform:macos.

How the mod decides, and what it misses

The mod's source and README are public in the Claude Code repository. It runs as a tool.check hook, reads the signed-in account's address, and refuses a shell call only when two things hold across the whole command: the address appears, in any letter case or percent-encoded, and a User-Agent is named, through words such as User-Agent and --user-agent or flags such as curl -A and wget -U. There is no parser, "on purpose", and the README accepts that it will refuse some legitimate calls.

The README is blunter about what it lets through. The routes below come from its own list.

Route	Stopped by the mod?
Shell call pairing the address with a User-Agent flag	Yes, refused
Address in a URL or request body	No
curl -u or a From: header	No
Address built from a variable, file or script	No
WebFetch, WebSearch and MCP tools	Not checked

The last row matters because the reporter says the leak happened "while conducting web searches." WebSearch is a tool the mod does not inspect, so a fix that covers curl -A may not cover the path the reporter describes. We could not tell from the issue which path was involved.

Why a model would write an email into a header

Wikimedia's User-Agent policy asks scripted clients to supply "some way of contacting you, the operator", and accepts an email address, a website or a wiki username. It says generic or empty agents "will fail with an HTTP 403 error" and may be blocked without notice, though "the requirement is not automatically enforced." A commenter in the issue spelled out the same chain: a site wants contact details, the user asks for research, the agent fills in the only contact it has.

The mod's off switches are also listed in the README: /plugin disable, the cc-plugin-privacy@builtin key in user or managed settings, a server-side switch read once per session, or a plugin hook that overrules the refusal. Repository-level settings do not count. A commenter, ConnorJC3, asked why the user's email is loaded into the model's context by default at all, and called the plugin a "bandaid." The reporter asked for removal of the behaviour from the harness, not a toggle. The thread shows no reply from Anthropic to that request, and the issue stays open.

For anyone running agents against sites with contact-address rules, the earlier fake Claude Code 2.1.313 incident is a reminder to check the installed version before trusting a fix, and the Superpowers token-cost issue shows how quickly agent-harness trade-offs land in a public tracker. The next thing to check is whether a Claude Code release after 2.1.318 lists the mod in /plugins.