Claude Code bug report alleges email leak in User-Agent header

A developer has filed a GitHub bug report saying Claude Code writes the signed-in user's email address into the User-Agent header of its outbound web-search requests, broadcasting the address to every site the agent touches. The reporter, taylor-edwards, opens with the consequence: "I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the `User-Agent` request header while conducting web searches without my permission."

He does not want a toggle. "This should not be a setting with opt-out or opt-in behavior, it needs to be removed from the harness entirely," the report says, adding that the current behavior "does nothing for services which dislike agentic traffic, does not preserve my anonymity on the web, and is a goldmine for scammers."

The complaint targets Claude Code version 2.1.318 on macOS. Anthropic's triage has tagged it area:security, area:tools, bug and platform:macos. The reporter signs off with a migration note: "I am migrating my company to Pi with OpenRouter since I have no faith in anthropic preserving my privacy."

Anthropic has not publicly replied on the thread as of filing, and the issue carries no reproduction log, no sample request dump and no indication of which versions first introduced the header. One early comment, from a user called Netkas, reads only: "Corporations care about your privacy."