Bug Report: Privacy violation in User-Agent header
A Claude Code user reports that the agent sent their email address to third-party sites in a User-Agent header. The claimed link to subsequent spam is not established, and HN commenters caution that the behavior may arise when an agent follows a site’s API-access instructions rather than from a header on every request.
An Anthropic contributor says the default-enabled cc-plugin-privacy is intended to block the behavior in versions 2.1.317 and later; the report concerns 2.1.318, so whether it covers this particular case remains unresolved. The issue is still open.