Claude Code leaked user emails via request headers, fixed in 2.1.321

On November 11, 2026, a report described a user email exposure issue in Claude Code: while fetching websites, the tool appended the user's account email as a contact field in the UA string, allowing sites to harvest it from server logs. The report said some developers had begun receiving heavy volumes of phishing email as a result and that the behavior had been in place for a long time. According to the same report, the fix is to upgrade to Claude Code 2.1.321, released on November 9, which rejects any Shell command that carries both an email address and a UA. Only one source has covered this so far, so the scale of the exposure and the exact number of affected users remain unclear. The relevant command is blocked rather than silently sanitized, which means legacy workflows that intentionally sent contact details with automated requests will stop working once the new version is installed, and users who cannot upgrade immediately may still leak their email unless they change how they invoke the tool. No independent confirmation of the behavior or the remediation has appeared yet, so the incident currently stands at the single-report stage with the recommended action being an upgrade to 2.1.321.