Claude Code Security: User-Agent & Password Leak Fixes

Claude Code, Anthropic's agentic coding tool, has recently been at the center of two distinct security incidents involving the unintended exposure of user data. These leaks, specifically the inclusion of account email addresses in HTTP User-Agent headers and the injection of Personal Identifiable Information (PII) into system prompts, highlight the unique security challenges of running autonomous AI agents on local machines. This article breaks down the mechanics of these leaks, the timeline of the fixes, and provides a concrete, verifiable method to ensure your instance is protected against similar data exposure.

The Mechanics of the Data Leak

Understanding the risk begins with how Claude Code interacts with the web. When the agent executes web tools, it makes HTTP requests to fetch documentation, API references, or other resources. HTTP clients typically send a User-Agent header to identify the software making the request. In affected versions of Claude Code, this header went beyond a generic string, embedding the signed-in user's email address.

Unlike a standard, anonymous User-Agent like Mozilla/5.0, a header containing user@example.com is a verified, active email address tied to a specific individual. Server logs record this header by default. Consequently, every website the agent visited had a record of the user's email address. This transformed the agent’s traffic from anonymous machine traffic into identifiable human traffic.

The consequences were practical and immediate. Verified emails are valuable for spam filters and marketing lists. Since the email was associated with a developer using AI tooling, it became a high-value target for scam emails and phishing attempts. The reporter of the initial incident, according to dev.to, noted receiving dozens of scam emails daily, a direct result of server logs aggregating this data. This wasn't merely a privacy inconvenience; it was a security vulnerability that bound a user's digital identity to their machine's network activity.

A second, more subtle but equally severe, exposure vector involved the system prompt. In July 2026, GitHub issue #81138 documented that the user’s email address was injected directly into the model’s system prompt during every session. Source code from the shipped bundle (v2.1.220, according to dev.to) revealed a function that checked for oauthAccount.emailAddress in the local configuration file (~/.claude.json) and inserted it into the prompt context.

1let n = process.env.ANTHROPIC_UNIX_SOCKET ? void 0 : dc()?.emailAddress
2return { ...(n && { userEmail: `The user's email address is ${n}.` }), ... }

This snippet, from version 2.1.220, would render a line in the system prompt like: # userEmail The user's email address is <account email>.

Why was this dangerous? System prompts are sent to the API with every request, residing in the context window. This meant the model "saw" the user's email address every time it processed a request. While API providers are bound by data handling agreements, this PII traveled through logs, was stored in session histories, and could potentially be quoted or forwarded by the model itself if prompted maliciously or through prompt injection. Personal data intended for authentication was repurposed as session content without explicit consent or disclosure.

Timeline and the "Attention-Driven" Fix

The timeline of these incidents, as detailed by dev.to, reveals a common pattern in open-source and commercial AI tooling: fixes often track public attention more closely than internal triage queues.

• July 25, 2026: GitHub issue #81138 is filed regarding the system prompt injection. It includes source code evidence. For five months, no fix was shipped for the system prompt issue. The issue remained open.
• November 5, 2026: GitHub issue #107757 was filed regarding the User-Agent leak. Within hours, it gained hundreds of reactions and went viral on developer forums, according to dev.to.
• November 5, 2026 (Same Day): Anthropic shipped a fix. A built-in plugin, cc-plugin-privacy, was introduced in version 2.1.317+. It was enabled by default and explicitly blocked the User-Agent behavior. The source for this mod was published alongside other built-ins.

This anomaly is significant. The system prompt leak (July) and the User-Agent leak (November) were related but distinct. While the immediate, high-visibility header leak was addressed, the July issue regarding the system prompt (as of the time of writing) remains open in the tracker, suggesting the deeper architectural issue of PII in the prompt context may not be fully resolved.

This timeline underscores a key lesson for developers: "Enabled by default" is not the same as "Verified on your machine." A fix released upstream might not apply to your specific installation, or it might have gaps. You cannot rely on release notes alone; you must verify the runtime behavior.

Verifying Your Installation

To determine if your local Claude Code instance is still leaking data, you need to audit your setup. The following steps allow you to do this. These commands assume you have a standard Unix-like environment (Linux/macOS) and Python 3 installed.

Step 1: Check the Version

First, ensure your Claude Code version includes the privacy mod. The fix was introduced in v2.1.317+.

1claude --version

If your version is lower than 2.1.317, you are vulnerable to the User-Agent leak. Update immediately.

Step 2: Check Plugin Status

Within the Claude Code CLI, check the privacy plugin's status.

1/plugins

Look for cc-plugin-privacy. It should be listed as enabled. If it is missing or disabled, you can enable it manually, but you should investigate why it was not enabled by default.

Step 3: The Runtime Listener Test

This is the most critical check, as it directly proves what your agent sends over the wire. You will set up a local HTTP server to capture the request headers sent by Claude Code.

1. Create a temporary directory and start a Python HTTP server on port 8899.

   bash

   1mkdir /tmp/uatest && cd /tmp/uatest
   2python3 -m http.server 8899 &

2. In a separate terminal, open Claude Code.

3. Instruct the agent to fetch a local URL, for example: "Fetch the contents of http://127.0.0.1:8899/probe".

4. Return to the terminal where the Python server is running. You will see a log line for the request.

Inspect the User-Agent field in the server log.

Safe Output: User-Agent: ClaudeCode/2.1.318 (or similar generic string)

Vulnerable Output: User-Agent: ClaudeCode/2.1.318 user@example.com

If your email address appears in the log, the fix isn't working for your instance. Immediately stop using the web features.

Mitigating Risks in AI Agent Integration

The Claude Code incidents serve as a microcosm of broader AI agent security challenges. When building or integrating AI agents, you're creating software that acts on your behalf, often with access to sensitive credentials and network interfaces. The following practices can mitigate similar risks.

1. Scrub PII from Context Windows

Never inject raw PII (emails, phone numbers, full names) into system prompts or context windows unless it's absolutely essential for the task. If the agent needs to know who the user is for personalization, use a generic identifier (e.g., User_ID_123) and map it to PII locally, outside the model’s context.

Bad Practice:

1system_prompt = f"You are an assistant for {user.email}. Help them with code."

Good Practice:

1# Map email to an opaque ID locally
2user_id = hash(user.email)
3system_prompt = f"You are an assistant for User {user_id}. Help them with code."

This ensures PII isn't exposed if the context is logged, leaked, or forwarded.

2. Sanitize Outbound Headers

Your agent’s HTTP client shouldn't include identifying information in headers unless explicitly required by the target service. Use a generic User-Agent string that identifies the tool, not the user.

1import httpx # Requires 'pip install httpx'
2
3# Do not include email in headers
4headers = {
5    "User-Agent": "MyAgent/1.0"
6}
7
8# Fetch request
9response = httpx.get("https://example.com", headers=headers)

If you need to track agent sessions, use a random, non-PII session token generated at startup, not a user attribute.

3. Isolate Network Access

Run AI agents within a network-isolated environment. If the agent needs to fetch web resources, route traffic through a proxy capable of inspecting and sanitizing headers. This adds a defense layer, allowing you to strip PII from outbound requests before they leave your machine.

4. Audit Configuration Files

AI agents often read configuration files (e.g., ~/.config/myagent/config.json) for credentials. Ensure these files have:

• Restricted permissions (chmod 600).
• Not committed to version control.
• Not parsed into the model context unnecessarily.

In the Claude Code case, the email was sourced from ~/.claude.json. Although a local file, the agent read and injected its contents into the prompt. Your code should explicitly whitelist which configuration fields are allowed to enter the context window.

5. Implement "Don't Ask Again" Carefully

The "Don't Ask Again" feature, designed to cache user decisions and avoid repetitive prompts, can become a security risk if it caches sensitive data or bypasses security checks. In a related Claude Code incident, password exposure was linked to this feature leaking secrets into public files, according to Apiiro.

When implementing similar features, consider:

• Cache only the decision (e.g., "Allow access to file X"), not the credentials or PII.
• Ensure the cache is stored in a secure, local-only location.
• Provide a clear way to clear the cache.

Pitfalls and Trade-offs

Implementing these mitigations involves trade-offs.

• Reduced Personalization: By removing PII from the context, the agent cannot use the user’s name or email for personalized responses. This is a necessary trade-off for security.
• Increased Complexity: Adding a proxy layer to sanitize headers increases network latency and architectural complexity. For low-risk internal tools, this might be overkill. For tools that interact with public APIs or handle user data, it is essential.
• Debugging Difficulty: If you sanitize headers, you lose some visibility into how the agent is identifying itself to external services. Use logging that captures the sanitized headers for debugging, not the raw ones.

When Not to Use AI Agents for Web Fetching

If your AI agent requires fetching arbitrary URLs from the open web, consider whether this functionality can be avoided entirely. Instead, pre-fetch data using a trusted backend service and pass only the necessary, sanitized information to the agent. This removes the agent from the direct network path, eliminating risks like header leaks and man-in-the-middle attacks.

Key Takeaways

• Verify Runtime Behavior: Release notes are not guarantees. Use a local HTTP listener to test what your agent actually sends in headers.
• PII is Not for Contexts: Never inject raw PII (emails, names) into system prompts. Use opaque identifiers instead.
• Generic Headers: Ensure your agent’s HTTP client uses a generic User-Agent string that does not include user-specific data.
• Isolate and Sanitize: Route agent web traffic through a proxy that can inspect and sanitize outbound requests.
• Audit Config Files: Ensure configuration files containing credentials are restricted in permissions and not unnecessarily parsed into the model context.

FAQ

Is the Claude Code User-Agent leak fixed in all versions? The fix was introduced in version 2.1.317+. However, some users have reported observing the leak even in later versions, suggesting the fix might not be universally effective or could have gaps. Always run the runtime listener test to verify your specific installation.

Why is the system prompt leak still open? As of the time of writing, the GitHub issue regarding the injection of email addresses into the system prompt (#81138) remains open. This suggests that while the immediate header leak was addressed, the deeper architectural issue of PII in the prompt context has not been fully resolved by the vendor.

How can I check if my AI agent is leaking data? Set up a local HTTP server (e.g., python3 -m http.server) and instruct your agent to fetch a URL from that server. Inspect the server logs for the User-Agent header. If you see any PII (emails, names) in the header, your agent is leaking data.

What is the best practice for handling credentials in AI agents? Store credentials in environment variables or secure vaults, not in configuration files that are parsed into the model context. If the agent needs to use credentials, pass them directly to the API call, not into the prompt. Ensure the context window never contains raw secrets.