Overview
A privacy vulnerability in Anthropic’s Claude Code (version 2.1.318) has been confirmed to expose authenticated users’ email addresses to arbitrary third-party web servers through the HTTP User-Agent request header. The issue, filed as GitHub issue #107757 on 5 November 2026, was opened by user taylor-edwards and has accumulated nearly 500 upvotes, indicating widespread impact across the Claude Code user base.
When Claude Code performs web searches as part of its agentic task execution, it appends the authenticated user’s email address to the User-Agent string sent with outbound HTTP requests. This means every web server contacted during an agent session receives the user’s personal identifier — without explicit consent, disclosure, or a meaningful opt-out mechanism.
Technical Analysis
The root cause appears to be the inclusion of session or account identity metadata within the HTTP User-Agent header, likely introduced as a telemetry or traffic-identification mechanism to distinguish agentic from human web traffic. While such identification may serve legitimate rate-limiting or policy-compliance purposes from Anthropic’s perspective, embedding PII — specifically email addresses — in a header transmitted verbatim to third-party servers is a significant design flaw.
HTTP User-Agent headers are logged by virtually every web server by default and are visible to:
- The destination web server and its operators
- Any CDN, reverse proxy, or WAF in the request path
- Network-level passive observers
- Ad networks and analytics platforms embedded in target pages
This creates a durable, low-effort email harvesting vector. Malicious site operators or compromised CDN logs could trivially extract and monetise these addresses at scale.
User-Agent: claude-code/2.1.318 (darwin) [email protected]
(Reconstructed example based on issue description; exact format unconfirmed)
Framework Mapping
MITRE ATLAS:
- AML.T0057 – LLM Data Leakage: The agent autonomously discloses PII (email) as a side-effect of tool use, without user awareness.
- AML.T0086 – Exfiltration via AI Agent Tool Invocation: The web search tool acts as the exfiltration channel for sensitive identity data.
- AML.T0084 – Discover AI Agent Configuration: Third parties passively receive configuration/identity data embedded in request metadata.
OWASP LLM Top 10:
- LLM06 – Sensitive Information Disclosure: Email addresses constitute PII and their transmission is unsanctioned.
- LLM08 – Excessive Agency: The agent performs actions (transmitting PII) beyond the scope of what the user authorised.
- LLM07 – Insecure Plugin Design: The web search plugin lacks adequate data minimisation controls.
Impact Assessment
All Claude Code users who use the tool’s web search or browsing capabilities are affected. The impact is primarily a privacy harm — enabling spam, phishing targeting, and identity profiling — rather than direct system compromise. However, in regulated jurisdictions (GDPR, CCPA), unsanctioned transmission of email addresses to third parties may constitute a notifiable data protection incident for enterprise users.
The reporter states they have migrated their company away from Claude Code as a direct result, suggesting reputational and commercial consequences for Anthropic.
Mitigation & Recommendations
- Disable Claude Code web search until Anthropic issues a confirmed patch stripping PII from outbound headers.
- Inspect outbound HTTP headers using a local proxy (e.g., mitmproxy, Burp Suite) for any agentic AI tool before granting internet access.
- Apply network egress filtering to prevent agentic tools from contacting arbitrary external hosts.
- Demand vendor confirmation of data minimisation practices in AI agent tooling before enterprise deployment.
- Review GDPR/CCPA obligations if Claude Code was used in a business context, as third-party PII transmission may require incident assessment.