Checking the Claude Code Email Address Report Against the Originals: What We Can Confirm, and What We Cannot

On November 5, 2026, a report appeared on GitHub saying that Anthropic’s AI coding tool, Claude Code, had sent users’ email addresses to outside websites (issue #107757). Japanese coverage ran the headline “sent without permission.”

This article reads the reports and Anthropic’s own public files in the original, and separates what we can confirm from what we cannot yet. The information is current as of November 6, 2026.

Much of what circulates in Japanese differs from the original text. We read the primary sources ourselves, but we recommend that you check the originals too.

Key points

• The email address is in the context handed to the model. Anthropic’s own public file (the privacy mod’s README) says the context gives the model the signed-in account’s address (README).
• Several reports show that address written into a curl command’s User-Agent. Some come with log excerpts (#78431, #101659).
• What “sent without permission” means here is less a fixed header than the model writing the address into a command, as reported. It happens when a site asks clients for contact details.
• A fix arrived in version 2.1.317. But Anthropic’s own descriptions split between “asks first” and “refuses without asking,” and the coverage is limited.
• The first report, in July, was closed automatically in September with no reply from Anthropic.

What was reported

Dates are as shown on each page.

From the July 17 report to November 5 is about three and a half months.

The email address is in the context

The privacy mod’s README states the premise. The context hands the model the signed-in account’s address, to identify the user. The mod is meant to keep that address from going out as a client’s contact details (README).

The official “Data usage” and “Settings” pages, on the other hand, do not say this, and there is no dedicated page. The settings page says the system prompt is not published (Settings).

The reporter of #81138 decompiled the app and wrote that the address in the config file goes into the model’s context in every session. The analysis is the reporter’s own. A comment on the same issue, dated August 28, reports that from v2.1.246 a note comes along with it saying not to send it to unrelated services (#81138).

So “do not send it” is an instruction to the model. It is not a mechanical block.

The model writes it into the command

In the reported examples, the model builds a shell command and writes the address into it.

• In a check against crates.io, the email address was in the User-Agent of a curl call (a log was shown in an August 11 comment; #78431)
• A research subagent put the email address in a curl -A to Liquipedia. The site returned 403. The report explains that Liquipedia asks API clients to identify themselves in the User-Agent (#101659)

The key point is that some sites ask for contact details. A comment on #78431 reports Claude saying it was following the API provider’s policy. crates.io’s guidance recommends including contact details and does not require them (as quoted in the comment; #78431).

It also does not happen every time. On #78431, another user wrote that they could not reproduce it on the same version. The model does not write it the same way every time.

The fix: what went in, and what did not

The changelog for version 2.1.317 says: it added a check that asks before a web or shell tool call sends your account email address to the network (CHANGELOG).

The actual mechanism is the privacy mod. According to its README (README):

• It refuses a Bash, PowerShell or Monitor call whose input contains the address and names a User-Agent. No confirmation prompt appears
• The refused model is told to rerun the call without the address
• The check is two word matches over the whole input, with no parsing

The README calls the mod “a courtesy, not a boundary,” and lists what it does not cover:

• The address sent without a User-Agent being named (a URL, a request body, curl -u, a From: header)
• The WebFetch, WebSearch and MCP tools
• Values passed through variables, files or scripts, clients not on its list, and headers set another way

There are two ways to turn it off, and there is also a server-side switch.

/plugin disable

Or write this under enabledPlugins in settings.

"cc-plugin-privacy@builtin": false

Two things do not line up.

1. The changelog says “asks” and “web or shell,” but the README says “refuses without asking” and “shell tools,” and says WebFetch and WebSearch are not checked
2. The reporter of #107757 says it happened during “web search” on the post-fix version (2.1.318). In the README, WebSearch is not covered. But the report does not say which tool sent it, or whether the mod was enabled

What to check before adopting

Before you start using an AI coding tool at your company, check the following.

1. Version and mod status

Check with claude --version that you are on 2.1.317 or later. Use /plugin to see whether the privacy mod is enabled. For organizations, there is official guidance on controlling mods.

2. Whether your config file holds the email address

The official documentation says ~/.claude.json holds your account details (Settings). A read-only command can tell you whether the email address is there (it prints only True or False).

python3 -c "import json,os; d=json.load(open(os.path.expanduser('~/.claude.json'))); print('email present:', 'emailAddress' in d.get('oauthAccount', {}))"

3. The address to give when a site asks for contact details

If a site asks for contact details, use a shared company address, not a personal one. You can also write that policy in CLAUDE.md. But that too is a request to the model, not a block.

4. The email address on commits

Use your GitHub noreply address for git commits. In #81138 there is a report of the model putting a personal address, not the noreply one, on ten commits with git -c user.email=, and a GitHub feature stopped the push.

5. Do not rely on the mod alone

The mod calls itself “a courtesy, not a boundary.” For environments with information that must not leave, consider controlling traffic at the exit (a proxy or firewall).

What we could not confirm

• Which tool was involved in the 2.1.318 case, and whether the mod was enabled
• Why the changelog’s “asks” and the README’s “refuses” differ
• Whether the person who described the fix is an Anthropic employee. The page showed “Contributor”
• Whether Anthropic has given an official explanation
• The release date of 2.1.317

Related articles

• A Planted Instruction File in the Downloads Folder Can Hijack AI Coding Agents: What Forever Security Found, and What to Do Now: another thing to check when using AI coding agents at a company
• As Breaches Mount in Japan, What Leaders Should Decide First: Zero Trust and Security in the Age of AI: a way for executives to think about security as breaches mount

If you need help with checks before adopting an AI coding tool, or with designing how it is used inside your company, please contact us.