Claude Code put your email in the User-Agent; 2.1.317 now asks before sending it

A User-Agent like my-session/1 <[email protected]> was all it took for a Claude Code account's email address to land in other people's server logs. On November 5, 2026, the thread "Claude Code sends your email address to websites" passed 600 points on Hacker News, and version 2.1.317, published to npm on November 2, already ships a check that asks for permission before a web or shell tool sends that address over the network.

01Why the agent was sending your email

It isn't a value hard-coded in the client. Since version 2.1.234 (August 17, 2026), the Claude Code changelog says the model "is now told" to use your account email only to identify you and not to send it to unrelated services unless you ask. In other words, the address sits in the model's context, and the only safeguard was a sentence of natural language.

The problem shows up when the agent writes its own HTTP requests with curl or a script. Some sites ask automated clients to identify themselves: Wikimedia's User-Agent policy, for instance, warns that scripts should send an informative User-Agent "with contact information" or risk being blocked without notice. A model that knows the convention and has your email at hand can conclude that the polite thing is to put it in the header. In the thread, one user says they now get phishing emails from sites they never visited; other users see nothing unusual in their headers. The link to the spam is unproven, but the leak isn't: any server that logs headers keeps the address.

The lesson goes beyond Anthropic: a prompt instruction is not a security control. If a piece of data is in the context of an agent with network access, assume it can get out.

02What changes in 2.1.317

The changelog entry is one line: "Added a check that asks before a web or shell tool call sends your account email address to the network". The difference is that deterministic code now inspects the call before it runs, instead of trusting the model to follow an instruction. The current release is 2.1.318, from November 3.

03How to update and check your version

With the native installer, Claude Code updates itself; to force it, or if you installed through npm:

claude update
# or, for the npm install
npm install -g @anthropic-ai/claude-code@latest
claude --version   # 2.1.317 or later

On machines with pinned versions (CI images, dev containers, self-hosted runners), check the version baked into the image: that is where old clients tend to linger for weeks.

04What the check doesn't cover

The changelog talks about your account email. The agent sees more addresses than that: the one in git config user.email, the ones in commits it reads with git log, or any address in the repository. If the email you use for Claude differs from the one on your commits, the new check doesn't protect the second one.

To close that gap with the same deterministic approach, a PreToolUse hook can deny any Bash command that contains your git email. The structure follows the example in the hooks documentation (it needs jq):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-email.sh"
          }
        ]
      }
    ]
  }
}

#!/bin/bash
# .claude/hooks/block-email.sh
# Deny Bash commands that include the git author email
COMMAND=$(jq -r '.tool_input.command')
EMAIL=$(git config user.email)

if [ -n "$EMAIL" ] && printf '%s' "$COMMAND" | grep -qiF "$EMAIL"; then
  jq -n '{
    hookSpecificOutput: {
      hookEventName: "PreToolUse",
      permissionDecision: "deny",
      permissionDecisionReason: "Command contains the git author email"
    }
  }'
else
  exit 0
fi

Save it under .claude/hooks/, make it executable with chmod +x, and extend the match to other strings you don't want leaving the machine, such as your company domain. It isn't bulletproof: an address encoded in base64, or written to a file before being sent, slips past it. For truly sensitive data, the rule stays the same: keep it out of reach of an agent that has network access.

05Sources

• Claude Code sends your email address to websites — Hacker News
• Claude Code changelog (2.1.234, 2.1.317, 2.1.318) — Anthropic
• @anthropic-ai/claude-code on npm — npm
• Wikimedia Foundation User-Agent Policy — Wikimedia Foundation
• Hooks reference — Claude Code Docs