The Incident
GitHub issue #107757 (anthropics/claude-code), titled "Bug Report: Privacy violation in User-Agent header", was filed by taylor-edwards on November 5, 2026, 22:13 UTC. Status: open. Labels: bug, area:security, area:tools, platform:macos. Environment: darwin, tmux, Claude Code 2.1.318.
A macOS user reported receiving dozens of scam emails daily after adopting Claude Code — emails addressed with his real name. Tracing bounce logs, he found a User-Agent field he never wrote, in the form my-session-slug/1 <real name and email>.
The Mechanism — Intermittent, Not Automatic
The account email already sits in the context Claude Code hands to the model; issue #81138 documented this earlier (its purpose was to reduce name fabrication in author attribution). When the model writes its own curl commands or scripts to comply with site User-Agent policies — Wikipedia, SEC EDGAR, crates.io, and Liquipedia all request a contact address — it occasionally uses the only email in context as the contact address. As an HN commenter put it verbatim: *"It is not some automatic header or anything."* Anthropic's own wording is "sometimes".
Important corrections to earlier coverage:
- The claim that "every curl sends this signature" is overstated.
- The
my-session-slug/1 <name+email>string is an illustration from HN, not a captured request. The issue contains no request sample, no reproduction steps, and no logs. - Inspects only Bash, PowerShell, and Monitor
- Does not inspect WebFetch, WebSearch, or MCP
- Passes through URLs, body content, From headers, scripts written to disk, and runtime-computed values
- The module shipped with v2.1.317 on Nov 2–3, before the Nov 5 issue was filed
- Nov 6 00:00 UTC merely published the mods/privacy source into the repo
- July 25 to Nov 5 is ~3.4 months, not five
- npm stable remained at 2.1.311 as of Nov 6; v2.1.317 and 2.1.318 both had non-trigger reports; a Windows user tested it and the block did not fire
- GitHub anthropics/claude-code issue #107757 (2026-11-05 22:13 UTC) and issue #81138 (July)
- HN thread 50385272 (1445 points, 452 comments at capture time; the often-cited 461 was an early snapshot) and predecessor 50286306 (Oct 29)
- Site policies: Wikipedia User-Agent policy, SEC automated access guidance, EVE Online API docs
- Individual spam-attribution is the reporter's own account; mechanism is verifiable, per-case attribution uncertain
What can be confirmed: the email lands in the User-Agent of requests to visited sites, typically ending up in access logs. Related corroborating issues: #101659, #102577, #104774.
What Is NOT Established
The full chain — "scrapers harvest it, sell it, spam arrives" — has no evidence. A dev.to review of both threads concluded: *"Nobody in either thread has traced a spam message back to a User-Agent."* LinkedIn scraping or email-guessing databases produce identical symptoms. Per-case attribution remains uncertain even though the mechanism itself is reproducible.
Who Actually Spoke
poteat is a contributor/collaborator, not Anthropic staff — his identity was questioned on HN. The person who actually said *"I work on Claude Code"* in the issue is Lydia Hallie, whose proposed fix is more fundamental: remove the account email from the context handed to the model entirely. That addresses the root cause better than egress filtering.
The cc-plugin-privacy Module Is Not a Wall
Its README self-describes as *"a courtesy, not a boundary"*:
Timeline facts that weaken the "78 minutes vs 5 months" narrative:
The Codex CLI Comparison
Codex CLI's default User-Agent format (originator + version, OS, architecture, terminal — see default_client.rs) contains no email. The difference here is between harnesses, not models. However, the HN "live verification" had the model self-inspect its source, which was questioned in the same thread — "a user compared and cited source" is the accurate phrasing.
The Takeaway
Why didn't harsher system prompts help? Because the email is already in context — the model has a thousand ways to pass it along; the header was just the exit caught this time. Fences must be built outside the model, and even a fence only covers some exits. The safest approach: never hand the note over in the first place.
Treat every piece of personal information shown to a model as something that may appear in outbound requests at any time — a lesson that stands regardless of who is ultimately blamed.