Claude Code was sending users' emails in User-Agent headers

A GitHub issue reports Claude Code putting the user's email into outbound User-Agent headers during web fetches, which the reporter links to a surge of scam emails. An Anthropic Claude Code engineer said models sometimes add a contact email because sites like Wikipedia ask scripted clients to identify themselves, and that a built-in cc-plugin-privacy mod in v2.1.317+ blocks the behaviour by default. HN (357 points, 116 comments): No consensus. One camp treats it as a serious PII leak and wants the email removed from the system prompt, not papered over with a plugin. Another camp focuses on harness design, arguing models will always improvise unless deterministic checks stop them. Sorted take: treat agent network access as a data-exfil surface; pin Claude Code versions and keep privacy plugins on.