On Wednesday night a user opened an issue in the Claude Code repository that hit 687 points on Hacker News within hours. His complaint: during a web search, Claude Code put his email address into the User-Agent header and sent it to third-party servers without asking. Since then he gets dozens of scam emails a day.
The issue is titled “Bug Report: Privacy violation in User-Agent header”. It was opened on November 5 at 22:13 UTC and carries the label area:security, among others. The reporter was running version 2.1.318. He writes that he is moving his company to a different harness.
Anthropic points to a mod that has shipped since 2.1.317
About an hour later a repository contributor replies: since v2.1.317 there is a built-in mod called cc-plugin-privacy that blocks this behavior deterministically. On by default, switched off through /plugins.
A second comment explains what happened. Nobody built the address-sharing as a feature. The sequence is this: Wikipedia requires scripted clients to identify themselves with a contact address in the User-Agent, a user asks Claude to research something on Wikipedia, and Claude puts its own account address into the curl call. His conclusion: “Models can be highly unpredictable.” Which is why deterministic checks around model behavior matter.
Since November 6, 00:00 UTC, the mod’s source sits in the repository under mods/privacy.
The check sits somewhere else than the damage
That README is unusually candid, and it answers the reporter’s case by itself. The mod holds one tool.check hook: a Bash, PowerShell or Monitor call is refused when its input holds the account address and names a User-Agent. Two word matches over the whole input, no parser, on purpose. False refusals are the accepted price.
Then comes the list of what passes. The address with no User-Agent named, in a URL, a request body or a From: header. A value computed at run time. A variable, a file. And this line: “A web tool call. WebFetch and WebSearch are not checked, and neither are MCP tools.” The README calls the mod a courtesy, not a boundary.
A web search is the path the reporter describes. It is not covered.
Two users cannot find the mod at all
Among the 36 comments, two people on 2.1.318 report that cc-plugin-privacy does not show up in /plugins at all; one says his logs confirmed the address going to other domains. A third rebuilt the documented case—an echo containing User-Agent: and his own account address—and watched it run, not get refused, on 2.1.317 and 2.1.318 across three surfaces.
The report is older than the outrage
One commenter points to issue 81138 from July, which said the same thing. The fix arrived when the story reached the Hacker News front page. If the model does not need the address in its context, it should not be handed it there either; a hook that counts two words only covers the cases somebody thought of.