A Claude Code issue reports account email in outbound User-Agent headers; a contributor points to a built-in block

The reporter, taylor-edwards, says Claude Code 2.1.318 on macOS sent their email address to third parties in the User-Agent header during web searches, and says they now receive dozens of scam emails a day. That is the reporter's claim; the issue does not establish the cause of the spam. A contributor replied that a built-in mod, cc-plugin-privacy, was introduced in v2.1.317 and later "to deterministically block this behavior," is on by default, and can be turned off in /plugins. The reporter's stated version is later than 2.1.317, and the contributor asked to hear about any gap in the mod's checks. The issue had 85 thumbs-up reactions when read.

Why it matters: An agent that browses or fetches on your behalf sends requests under your identity, and the harness decides what rides along. Check the outbound headers your agent actually sends, and note that this protection is a default-on mod you can disable.