Claude Code被曝请求头泄露邮箱，官方临时插件存盲区
Start here
Claude Code被曝存在隐私泄露风险。该工具因将用户登录邮箱置于模型上下文中，导致模型在自主编写网络请求命令时，可能将邮箱信息写入User-Agent请求头中造成外泄。针对该问题，Anthropic在2.1.317及以上版本中内置了名为cc-plugin-privacy的临时插件尝试进行过滤拦截。然而相关排查显示，该检查目前仅覆盖部分Shell调用，尚无法有效拦截通过MCP工具、WebFetch或脚本写入操作所引发的泄露。
AI-generated from reports · Updated 10 hours ago
Report timeline
Follow the reports to see different sides of the story.
- Hacker News · AISelectedHow to troubleshoot and block email leaks in Claude Code request headers
Because Claude Code places user login emails in the model context, the model can inadvertently write them into User-Agent request headers when autonomously generating network request commands, causing privacy leaks. Anthropic introduced a temporary built-in cc-plugin-privacy plugin in version 2.1.317 and above to filter this data; however, the check only covers certain shell invocations and cannot intercept MCP tools, WebFetch, or script-based writes.
Story heat trend
Current heat 8·Comparable peak 10（Nov 7 01:00）·Comparable change, last 24 hours–
Trends compare only the same parties observed continuously, so the scope can be narrower than current heat counts. Move the pointer or tap the chart to see hourly heat; use the left and right arrow keys on a keyboard.