### Preflight Checklist - [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet - [x] This is a single bug report (please file separate reports for different bugs) - [x] I am using the latest version of Claude Code ### What's Wrong? you stupid agent used my real email as user agent string without asking anything ### What Should Happen? asked for a tool for analyze used email as part

[BUG] you stupid agent used my real email as user agent string without asking anything

Status Open

Maintainer reply None cached

Activity 6 comments · opened Jul 17, 2026

Preflight Checklist

[x] I have searched existing issues and this hasn't been reported yet
[x] This is a single bug report (please file separate reports for different bugs)
[x] I am using the latest version of Claude Code

What's Wrong?

you stupid agent used my real email as user agent string without asking anything

What Should Happen?

asked for a tool for analyze used email as part of UA without asking

Error Messages/Logs

Steps to Reproduce

email address sent in header User-Agent without explicit confirmation

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

v2.1.212

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

IntelliJ IDEA terminal

Additional Information

using sonnet 5.0

View original on GitHub ↗

4 Comments

mt-empty · 19 days ago

yes same here, curl commands are passing my email address, who thought this was a good idea!

edit: here is the tool call from the session logs

[
    {
        "type": "tool_use",
        "id": "toolu_014TPt3memE3nvxvcrNhdEfx",
        "name": "Bash",
        "input": {
            "command": "curl -s -H \"User-Agent: ashurbanipal-publish-check (********@*********.***)\" https://crates.io/api/v1/crates/ashurbanipal-axum"
        },
        "caller": {
            "type": "direct"
        }
    }
]

I have masked my email, 5 occurances in a 1 hour session.

Xe · 19 days ago

What does the generated user agent string look like?

tosh · 19 days ago

@lgualtieri75 can you provide more context re when this happened?

teidesu · 19 days ago

cant reproduce on claude 2.1.212, macos, sonnet5, so likely not a harness issue

what claude code does however is injecting the userEmail into system context/reminders:

so the most likely explanation is that claude (the model) decided it should add it as a header for whatever reason

Showing cached comments. Read the full discussion on GitHub ↗