Sam LABBE
Claude Code put your account email in the User-Agent header of its web requests, so every server log on the agent's path harvested a scam-ready lead, and the same email ships in the system prompt of every session, an issue open since July. Fixed by a built-in mod in 2.1.317 after the issue went…
The User-Agent header travels with every HTTP request your tools make, and it is logged by default on virtually every web server on earth. Claude Code's web tooling included the signed-in account's email in it. Consequences, in increasing order of bad:
And the kicker, which the reporter stated plainly: the identifier did nothing useful. It did not help services distinguish agentic traffic (a coarse marker would), it destroyed the anonymity of the session, and it was a scammer goldmine. PII in a header is the worst of both worlds: no functional benefit, total exposure.
Excerpt from DEV Community ↗, by Sam LABBE.
Claude Code was mailing your email address to every website it visited: the User-Agent leak, the 5-month system-prompt issue, and the 5-point check was first seen on DEV Community · Top this week on Nov 8, 2026. Since then it has appeared in 3 checks on 1 different day. Its best position was #30 of 30, reached on Nov 8, 12:43 UTC. It is #30 right now, holding steady at #30 over the last 3 checks.
Position on DEV Community · Top this week at every check (lower is better).
Best rank per day (UTC).
♥ as reported by DEV Community.
Archived daily, weekly and monthly lists that include this entry.
Yes. As of Nov 8, 14:43 UTC it is #30, holding steady at #30 over the last 3 checks.
#30 on DEV Community · Top this week, on Nov 8, 12:43 UTC. Trendoday checks this list every 60 minutes.
It was first seen on Nov 8, 2026 and has been on the list on 1 day (3 checks) since.