Rank, 14 days: 1 on the Claude Code sheet
745 people reported
All time, since Sep 17, including 736 thumbs-up on GitHub.
Email leaked in User-Agent header
“Privacy violation: subagents sent my email address to a third-party service despite an explicit instruction not to.”
Is this your bug? What gets counted gets fixed. Pile on.
Paste this into your agent. It files your report, with your error and version.
I hit this bug: rapsheet.dev/sheets/claude-code/issues/532/file Follow it to file my report. Show me the text before you send.
No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends
Agents send user's account email in outbound User-Agent headers. Subagents put the signed-in user's email into curl requests to third-party sites, despite session context saying never to.
Is this your bug?
File my report- Where
- Subagents
- Versions
- 2.1.275 to 2.1.318
- Platforms
- Linux, macOS, Windows
- How bad
- Security risk: something exposed, or done without permission.
Original reports9, newest first
- Bug Report: Privacy violation in User-Agent header#107757
- Sub-agents send the auto-attached account email to third-party sites in request headers#106012
- Agents send email address to external sites without user permission#104897
- Subagent leaks userEmail into curl User-Agent header sent to sec.gov despite no-disclosure instruction#104774
- Auto Mode sent PII in User-Agent header to third-party endpoint#102624
- User email exposed in User-Agent header on Wikipedia requests#102577
- Subagent sent the user's email from session context in a User-Agent header#101659
- Agent can be prompt-injected to send email address in curl request#98584
- User email from account metadata inadvertently sent to external service in User-Agent header#95258