Claude Code privacy plugin blocks email leakage in curl User-Agents

·2026.11.06 17:06

Key point

Anthropic's new privacy mod blocks email exposure in curl calls, but its README describes the protection as a courtesy rather than a boundary.

A user claiming to work on Claude Code reports that the tool sometimes includes the account email in the User-Agent header of its own curl calls.
Anthropic's new privacy mod blocks this specific shape of data leakage, but the official README explicitly labels the feature as "a courtesy, not a boundary."
The privacy mod does not check WebFetch, WebSearch, MCP tools, or scripts for similar exposure.
Users should run claude --version and update if below 2.1.317, look for cc-plugin-privacy in /plugins, and inspect curl User-Agent headers for email addresses before approval.

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.