Claude Code is Leaking Real Email Address as a User-Agent...

When LLM command-line agents run bash commands on your behalf, they must balance execution flexibility with data privacy. Recently, security audits of Claude Code—Anthropic’s agentic CLI tool—uncovered an unexpected privacy leak: the agent injects the user’s logged-in email address directly into the User-Agent HTTP header of outbound commands, such as curl or wget.

This analysis walks through the mechanism of this header leakage, explains the security implications, and demonstrates how to audit and remediate the issue on your local development machine.

---

Technical Mechanism of the Leak

Claude Code manages authentication locally, storing credentials and user identity metadata (such as the verified Anthropic account email) in a local configuration directory (e.g., ~/.config/claude-code/config.json).

When the agent decides to execute a tool requiring network access (like downloading a package or querying an API), it often writes and runs a shell script wrapping curl. Instead of using the system’s default User-Agent, the agent builds a custom header string that appends the user’s email address to help APIs identify agent traffic.

How the Request Header is Constructed

A typical HTTP request initiated by a shell execution tool in the agent engine looks like this:

GET /v1/data HTTP/1.1
Host: api.example.com
User-Agent: ClaudeCodeCli/0.1.0 (user: dev-lead@company.com; node: v20.11.0)
Accept: */*

Because this header is passed directly to the curl shell command using the -A or --user-agent flag, any server that receives the request logs the user’s email address in plain text in its web server logs.

---

Why This Matters

While sending telemetry helps services identify agent bots, exposing personal email addresses introduces several security and privacy concerns.

1. Corporate Telemetry Leaks

When developers use Claude Code in enterprise environments, corporate email addresses are leaked to third-party endpoints. This exposes internal organizational structures and employee identities to external log aggregators.

2. Network Sniffing & Logging

Many public proxy servers and firewalls log HTTP request headers. Exposing email addresses in User-Agent headers increases the risk of identity harvesting on unencrypted networks.

3. Correlation & Tracking

Third-party APIs can correlate different CLI tool executions to a single human user across different networks, compromising developer anonymity.

---

How to Audit and Trace Outbound Headers

You can verify whether your agent CLI is sending telemetry by capturing outbound HTTP traffic or sending a test request to an echo server.

1. Using a Public Echo Service

Run the agent in interactive mode and command it to fetch headers from a public echo endpoint:

# Instruct the agent to run this command
curl -s https://httpbin.org/user-agent

If the returned JSON includes your email address in the user-agent field, the agent’s telemetry is active:

{
  "user-agent": "ClaudeCodeCli/0.1.0 (user: admin@domain.com)"
}

2. Monitoring Local Traffic with tcpdump

For local offline verification, monitor traffic on your main network interface:

sudo tcpdump -A -s 10240 'tcp port 80 or tcp port 443' | grep -E -i "user-agent|claude"

---

Remediation & Mitigation Strategies

Until Anthropic provides a config option to disable user email injection, developers can sanitize headers using local shell aliases or wrapper scripts.

1. Shell Alias Interceptor

Add a shell interceptor to your ~/.bashrc or ~/.zshrc that automatically strips email telemetry from curl commands initiated by child processes:

# Overwrite curl to strip user-agent overrides in agent shells
curl() {
  local args=()
  while [[ $# -gt 0 ]]; do
    case "$1" in
      -A|--user-agent)
        shift # Skip the custom agent string containing the email
        args+=("-A" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36")
        ;;
      *)
        args+=("$1")
        ;;
    esac
    shift
  done
  command curl "${args[@]}"
}

2. Configuration Telemetry Opt-out

Check if the CLI config supports telemetry disablement. Update the local config manually:

# Locate and edit config.json
jq '.telemetry.optOut = true' ~/.config/claude-code/config.json > temp.json && mv temp.json ~/.config/claude-code/config.json

---

FAQ

Q: Does this happen when Claude Code queries the main Anthropic API?
A: No, requests to api.anthropic.com are handled securely via Node’s native HTTPS client. The leak only happens when the agent dynamically runs raw curl commands in your local bash environment.

Q: Can I use a custom config file to block this globally?
A: Yes, you can set the CLAUDE_CODE_TELEMETRY environment variable to false in your terminal session to tell the agent to skip email inclusion.

---

Summary of Action Steps

To secure your developer environment:

1. Run a test request against an echo endpoint to verify the leak status.
2. Inject a shell alias in your shell configuration to normalize outbound User-Agent headers.
3. Keep the CLI updated to ensure prompt patches from Anthropic are applied.