Claude Code is leaking real email address as a User-Agent string in curl command

The user observed that Claude Code places their real email address directly into the User-Agent header of curl commands it generates. This occurs without any prompt or explicit permission from the user to include personal data in the request header. The header is transmitted to every server contacted by the tool during its operation.

The behavior was reported in Claude Code version v2.1.212 running on macOS inside the IntelliJ IDEA terminal. The issue is marked as a regression, indicating that a previous version did not send the email address in the User-Agent. Labels attached to the report include area:networking and area:security, reflecting the nature of the leak. The reporter also notes they were using the sonnet 5.0 model at the time.

Exposing an email address in a User-Agent header allows any remote host that receives the request to harvest that address for spam, phishing, or other unwanted contact. Because the header is part of standard HTTP traffic, the leak is not easily obscured by typical network privacy tools. The security label suggests the maintainers view this as a violation of expected confidentiality.

At present the report does not confirm whether the leak occurs on other operating systems, terminals, or versions of Claude Code. No mitigation or workaround is described in the issue, and the status remains open. Users who rely on Claude Code for automated HTTP requests should treat the email exposure as an active privacy risk until a fix is released.