Claude Code Bug Report Alleges User Email Exposure in HTTP User-Agent Header
A bug report against Claude Code v2.1.318 alleges the signed-in user's email address is placed into the User-Agent header of requests made by the agent, with no opt-out currently available.
A bug report filed against Anthropic's Claude Code, version 2.1.318, alleges that the email address of the signed-in user is included in the User-Agent header of HTTP requests made by the coding agent. According to the report, the harness injects the account email from its local configuration into the session context, and the model then places it into the User-Agent header when visiting sites that request contact identification, such as Wikipedia and SEC EDGAR. The report states that no opt-out is available, and Anthropic has triaged the issue under its security area; no fix release has been announced.
The project issue tracker shows similar reports dating back to July 2026, and the latest filing includes complaints of unsolicited email as a consequence. The case highlights a broader design consideration for AI agents: context injected by the harness can influence model decisions in ways that prompt-level instructions alone do not reliably prevent.