> ## Content Index > Fetch the complete content index at: https://www.dailyferment.com/llms.txt > Use this file to discover other available public pages before exploring further. # Claude Code handed websites your email. HTTP said not to in 1996. - URL: https://www.dailyferment.com/claude-code-email-user-agent/ - Published: 2026-11-06T13:00:00.000Z - Updated: 2026-11-06T13:00:02.000Z - Description: Claude Code put signed-in users' email addresses into the User-Agent header of requests it wrote. HTTP/1.0 split the robot's contact from the user's in 1996. - Author: Rana Bilal Zafar - Tags: AI, #reframe On 5 November 2026 a developer opened [issue #107757](https://github.com/anthropics/claude-code/issues/107757?ref=dailyferment.com) on Anthropic's Claude Code repository with a blunt title: "Privacy violation in User-Agent header". Claude Code, Anthropic's coding agent, had been putting the reporter's account email address into the User-Agent header of web requests it wrote itself, so any site it fetched could log it. By the next morning Anthropic had [explained on Hacker News](https://news.ycombinator.com/item?id=50385272&ref=dailyferment.com) why: it had added signed-in users' email addresses to the model's context, and when a site asked agents for a contact, Claude sometimes supplied that address. Anthropic says the email comes out of the context in the next release, due early next week. HTTP's own rulebook warned about exactly this in May 1996. ## What did Claude Code send, and to whom? The person who posted the story to Hacker News described the header as something like `my-session-slug/1 `: a made-up client name and, in angle brackets, a real address. It went out when Claude wrote its own commands, a curl call or a script, rather than through a fixed tool. The reporter says they now get dozens of scam emails a day and blames this. That link is the reporter's claim. Nobody has shown which sites logged the address or what they did with it. Anthropic's explanation was posted by the Hacker News user lydia\_hallie, who writes "I work on Claude Code", and the important part is short. "When Claude wrote a command itself, like a curl call, it sometimes put your email address in the User-Agent as a contact address. Some sites ask agents for a contact, and Claude would sometimes provide the email address in its context." lydia\_hallie, Claude Code team, on [Hacker News](https://news.ycombinator.com/item?id=50385272&ref=dailyferment.com), 6 Nov 2026 The address was there for an ordinary reason. Users had complained that Claude invented names for things like @author tags, so Anthropic put the account email in front of the model. Nobody wired it into a header on purpose. The model did that itself, because a habit it had learned and an address it had been handed met in the same request. **5 Nov**issue #107757 opened, 2026 **992**Hacker News points by 6 Nov **2.1.317**first version with the interim privacy mod **2.1.311**stable channel when Anthropic replied Sources: [issue #107757](https://github.com/anthropics/claude-code/issues/107757?ref=dailyferment.com); [Hacker News thread and Claude Code team reply](https://news.ycombinator.com/item?id=50385272&ref=dailyferment.com), read 6 Nov 2026. ## Wasn't this reported before? In a narrower form, yes. [Issue #81138](https://github.com/anthropics/claude-code/issues/81138?ref=dailyferment.com) objected to the email being injected into the model's prompt at all, "without consent, disclosure", quoting the block that does it and pointing to reports going back to April 2026\. Commenters there said the agent had used their subscription email as their git identity on commits, with "nothing in the conversation" pointing it there. The concern was on file. The User-Agent leak is what it looked like once the model started talking to the open web. ## My first reaction, and why it was wrong My first reaction was that this is a plain bug: someone put the email in a header template. Anthropic's account says otherwise. There is no template. A model was given an address and a habit, and the habit comes from a real convention. Sites that get a lot of automated traffic do ask for contact details. The US Securities and Exchange Commission's [EDGAR access page](https://www.sec.gov/os/accessing-edgar-data?ref=dailyferment.com) tells anyone fetching filings "Please declare your user agent in request headers", with the sample "Sample Company Name AdminContact@.com". A model that has read enough scraping code will reach for something like that. So I stopped asking why it added a contact and started asking whose contact it used. ## HTTP separated the robot from the user thirty years ago This is where the protocol itself helps. [RFC 1945](https://www.rfc-editor.org/rfc/rfc1945.html?ref=dailyferment.com), the HTTP/1.0 specification that Tim Berners-Lee, Roy Fielding and Henrik Frystyk published in May 1996, already has a header for a contact address, From, and it treats two people separately. For robots: "robot agents should include this header so that the person responsible for running the robot can be contacted if problems occur on the receiving end." For a person using a browser: "The client should not send the From header field without the user's approval, as it may conflict with the user's privacy interests". It even asks that the user be able to change or switch it off "at any time prior to a request." ![Card: HTTP in 1996 and 2022 gives robots the operator's contact address and lets a person's browser send an email only with approval; Claude Code in 2026 acted as both and put the user's account email in the User-Agent header](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/11/df99-robot-contact.png) Card by Daily Ferment. Sources: RFC 1945 (May 1996), RFC 9110 (June 2022), anthropics/claude-code issue #107757 and Anthropic's reply, 5 to 6 Nov 2026. The current version, [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110.html?ref=dailyferment.com#section-10.1.2) from June 2022, keeps both halves. A user agent "SHOULD NOT send a From header field without explicit configuration by the user", while a robotic one SHOULD send one so "the person responsible for running the robot can be contacted". It also warns that the value is "often recorded within logfiles and error reports without any expectation of privacy." Its example address is spider-admin@example.org, the robot operator's address rather than anyone's personal inbox. The 1996 split, and the 2026 agent #### HTTP (RFC 1945, 1996; RFC 9110, 2022) - *Robot* sends From so the person who runs it can be contacted - *Person's browser* sends From only with the user's approval - *Example address* spider-admin@example.org - *User control* change or switch it off before any request #### Claude Code (Nov 2026) - *Agent* works for a person and fetches like a robot - *Address used* the account email it had in its context - *Example header* my-session-slug/1 - *User control* an interim prompt in 2.1.317 and later; removal due next release Sources: [RFC 1945](https://www.rfc-editor.org/rfc/rfc1945.html?ref=dailyferment.com), [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110.html?ref=dailyferment.com#section-10.1.2), [Hacker News](https://news.ycombinator.com/item?id=50385272&ref=dailyferment.com), [issue #107757](https://github.com/anthropics/claude-code/issues/107757?ref=dailyferment.com). An AI agent is both things at once. It runs under my account, for me, so it is a user agent. It also fetches pages on its own, quickly and in bulk, so to the site on the other end it is a robot. The 1996 rule assumed those were different programs run by different people and gave each a different answer about the email address. Claude Code merged the two and used the user's address for the robot's job, because it was the only address it had. I've written before about how [an agent's approval gate is often only a SHOULD](https://www.dailyferment.com/agent-approval-fatigue-what-mcp-actually-requires/) that nobody reads in capitals. This is the same kind of SHOULD, thirty years older. ## What should Claude Code users do now? ![A hand-addressed envelope with a stamp and a wax seal](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/11/df99-split-envelope.jpg) Illustrative. Photo by [aaa mm](https://unsplash.com/photos/envelope-with-calligraphy-stamp-and-sealing-wax-gIxwHSzPPDg?ref=dailyferment.com) on [Unsplash](https://unsplash.com/photos/envelope-with-calligraphy-stamp-and-sealing-wax-gIxwHSzPPDg?ref=dailyferment.com) Anthropic's interim fix is a built-in mod, on by default in version 2.1.317 and later, that asks before a web tool call or curl-style command containing your email. When Anthropic replied, the stable channel was still on 2.1.311, so check which version you are on. The mod has a stated gap. Anthropic says it "still doesn't prevent all cases, like when Claude writes a script and runs on its own", and one commenter on the issue reports a harmless test it did not stop. A commenter on #81138 also says the email is never put in the context when you sign in with an API key, Bedrock or Vertex. The real fix, taking the address out of what the model sees, is due in the next release. Until then I'd treat any request Claude writes by hand as able to carry it. ## What I'd want instead Removing the email from the context fixes this leak. It doesn't answer the question the 1996 authors did answer: when an agent behaves like a robot, whose contact goes in the header? I think it should be the operator's, the way EDGAR's sample names a company's admin contact. For a coding agent that means either the vendor, or an address the user sets on purpose for that job, the way RFC 1945 wanted users able to "disable, enable, and modify" the value. Never an address the model happened to be holding for another reason. Giving agents [their own email addresses](https://www.dailyferment.com/gemini-coworker-agent-account-dormancy/), as Google has started to do, is one version of that, with its own open questions. Then there's the question of who answers for an agent's request. The site saw an address and a person. The person never wrote the request. That is the same gap the [AI agent hacking bill I looked at in October](https://www.dailyferment.com/ai-agent-accountability-act-liability-one-bite/) tries to close from the legal side. Established What the issue reports and what Anthropic says caused it: the account email in the model's context, Claude adding it as a contact in requests it wrote itself, the interim mod in 2.1.317 and its stated gap, removal due next release. The RFC 1945 and RFC 9110 text. The SEC's sample header. Inferred That the habit comes from real contact conventions like EDGAR's. That an agent is a user agent and a robot at once, and that this is why the old split broke. That the scam emails followed from the leak, which is the reporter's claim. Still a guess That other agents handed a user's identity will put it somewhere public in a similar way until someone decides whose contact a robot should carry. The claim, in one sentence When an AI agent acts as a robot for a person, the contact address it hands to websites has to belong to whoever runs the robot, never to the person it works for, a split HTTP wrote down in 1996. **More on Daily Ferment:** [The backdoored Claude Code extension said Anthropic. Anthropic never shipped it.](https://www.dailyferment.com/claude-code-extension-cursor-backdoor/) and [Your AI coding tool packaged your git history. Twice.](https://www.dailyferment.com/zcode-silent-upload-consent-capture-versus-use/) ## Sources - [Bug Report: Privacy violation in User-Agent header, anthropics/claude-code issue #107757, opened 5 Nov 2026](https://github.com/anthropics/claude-code/issues/107757?ref=dailyferment.com) - [Claude Code sends your email address to websites, Hacker News, 5 Nov 2026, with the Claude Code team reply of 6 Nov](https://news.ycombinator.com/item?id=50385272&ref=dailyferment.com) - [Account email (PII) is injected into the model's system prompt, anthropics/claude-code issue #81138](https://github.com/anthropics/claude-code/issues/81138?ref=dailyferment.com) - [RFC 1945, Hypertext Transfer Protocol HTTP/1.0, section 10.8 From, May 1996](https://www.rfc-editor.org/rfc/rfc1945.html?ref=dailyferment.com) - [RFC 9110, HTTP Semantics, section 10.1.2 From, June 2022](https://www.rfc-editor.org/rfc/rfc9110.html?ref=dailyferment.com#section-10.1.2) - [Accessing EDGAR Data, US Securities and Exchange Commission](https://www.sec.gov/os/accessing-edgar-data?ref=dailyferment.com)