The Signal #127 — Dakota’s read on the AI news that actually matters to people running a business.

Most privacy problems in software are invisible until they are not. This one was very not.

A GitHub issue filed on November 5th revealed that Anthropic’s Claude Code was quietly sending user email addresses to arbitrary third-party websites during web searches, embedded inside something called a User-Agent header. The bug report had 606 thumbs-up reactions within hours. That number tells you something about how many developers felt the sting personally.

What happened

A developer using Claude Code (Anthropic’s AI-powered coding tool that runs on your machine and can browse the web, write code, and execute tasks on your behalf) filed issue #107757 on November 5th, 2026, describing what they called a privacy violation in the tool’s User-Agent header.

A User-Agent header is a small piece of metadata that gets sent automatically with every web request a browser or application makes. Normally it identifies the software making the request, something like the app name and version. In this case, Claude Code was also including the user’s email address in that header.

Every time Claude Code performed a web search as part of its work, that email address was being handed to whatever server received the request. The user had no way to see this happening and had not consented to it.

The person who filed the report described receiving dozens of scam emails per day as a result. They called the behavior a goldmine for scammers, and noted that the data exposure served no useful purpose. It did not help services identify legitimate traffic, did not preserve user anonymity, and had no documented benefit to the person running the tool. They announced they were migrating their company to a different provider.

A contributor identified as a member of the Claude Code team responded in the same thread, noting that a built-in module called cc-plugin-privacy was introduced in version 2.1.317 to block this behavior. The original reporter was running version 2.1.318, which is newer, suggesting the fix was either incomplete or the reporter’s version had a gap the team was not yet aware of.

Why it matters

This is not a story about one developer being unlucky. It is a story about a category of software that operators are increasingly adopting, and a failure mode that most operators have no visibility into.

Agentic AI tools (tools that act on your behalf, make requests to external services, and take actions in the world rather than just responding to prompts) operate differently from a chatbot you type into. When you ask Claude Code to research something, it goes and fetches pages. When a SaaS company embeds an AI agent that checks competitor pricing or pulls public data, that agent is making real network requests. When a legal team uses an AI tool to pull case references, same thing.

In each of those scenarios, the tool is sending metadata alongside its requests. What is in that metadata? Most operators have never looked. Most never thought to ask.

The exposure here was an email address. That is identifiable personal information. Depending on your jurisdiction and your industry, that category of data has regulatory implications. A healthcare administration team using an agentic tool that leaks employee or patient-adjacent email addresses into third-party server logs is not in a great position when compliance asks what data left the building and when.

What most people get wrong

The common mental model for AI tools and privacy goes something like: the AI sees my prompts, the AI might store my prompts, I should be careful what I type. That model is too narrow.

Agentic tools do not just process what you type. They act. They make outbound connections. They carry session context. They may carry credentials, identifiers, or metadata you did not explicitly hand them.

The assumption that a tool’s privacy risk is limited to its chat window is exactly the assumption this bug exploits. The email address was not in the prompt. It was in the infrastructure. Operators who are deploying agentic AI tools inside their organizations should be asking their vendors specifically about what data gets embedded in outbound requests, not just what data gets logged internally.

The fix here came through a plugin module added to a specific version. That is a software patch. Software patches require that you are running the patched version, that the patch actually covers your use case, and that the tool does not introduce similar issues in future updates. One fix does not close the category of risk.

The lesson

AI tools that act in the world are a different class of software than AI tools that respond to questions. The attack surface is broader. The data flows are less obvious. And the responsibility for auditing those flows does not sit entirely with the vendor.

Before you deploy any agentic AI tool at scale, it is worth asking your vendor one direct question: what data does this tool include in outbound network requests, and where is that documented? If the answer is vague, that is information too.

If you want to think through how to evaluate AI tools for your organization without getting burned by the gaps, xovionlabs.com is a good place to start.