Claude Code Sometimes Sent Your Email to Websites: What Happened and What to Check

Claude Code sometimes sent your account email address to websites in requests it wrote itself. Anthropic confirmed the behavior and apologized. Anthropic says the removal comes in the next release, expected early in the week of November 9, 2026. The 2.1.319 release notes (November 6) don't mention it. The built-in check available in newer versions has gaps.

What happened

GitHub issue #107757 opened on November 5, 2026. Lydia Hallie, who works on Claude Code, explained that when Claude wrote a command itself, such as a curl call, it sometimes put the signed-in user's email in the User-Agent header as a contact address.

At the November 8 source snapshot, the issue had 984 reactions and 106 comments. The Hacker News discussion had 1,596 points. Those counts measure discussion activity. The number of affected users is unknown.

Why the email was there

Anthropic says users had reported Claude inventing names for things like @author tags. It added the signed-in account's email to the model's context to help with that.

Some sites ask agents for a contact address, Hallie explained. When Claude wrote a request, it sometimes used the email already in its context.

Here's an illustration of that request shape, using a placeholder address:

curl -A "my-tool/1.0 (you@example.com)" https://example.com

This example illustrates the request format.

What Anthropic says, and when

Hallie apologized in a reply posted November 6 UTC, late November 5 Eastern time. She said Anthropic was removing the account email from the context Claude Code gives the model. The update was promised for the next release, expected early the following week, meaning the week of November 9.

The 2.1.319 release notes (November 6) don't mention email removal, so those notes do not confirm its release status. The announced change and the existing check are separate updates.

What the stopgap catches, and what can pass

Versions 2.1.317 and later include a built-in privacy check, on by default. The stable channel was still on 2.1.311 at the source snapshot, before that check. Anthropic's advice was to update to 2.1.317 or later.

But Hallie said the check doesn't prevent every case, including when Claude writes a script and runs it itself. The privacy mod README also lists gaps: an address held inside a script, or an address in a URL or request body without a User-Agent named.

The README calls the check "a courtesy, not a boundary". Treat updating as adding the limited check, separately from the announced context removal.

How to check your own logs

Users morsik and mkubenka in the GitHub issue describe searching Claude Code session logs under ~/.claude/projects/**/*.jsonl for their own email address. That's a user-described inspection method.

• Search those session logs for your account email locally.
• Inspect matching entries for commands Claude wrote itself, especially curl calls and User-Agent contact fields.
• Read the surrounding entry before treating a text match as an outbound request.

One user (morsik) posted a Claude-generated review of their own logs reporting 53 calls across 8 sessions containing their email in a User-Agent, dated August 9 through November 1, 2026. That's one user's report, unverified here. It doesn't establish how many people were affected.

The builder angle (my opinion, no income guaranteed)

Sell small dev teams a privacy check: search their agent logs for emails and keys, then add a hook that checks outbound requests for their emails and keys, tested against scripts, with its gaps documented. Keep the deliverable concrete: a record of findings, the installed versions, and a hook tested against the outbound cases the team uses.

Start with their agents' session logs, searching for email addresses and keys. The email-search technique comes from users in the issue. Bring everyone to 2.1.317 or later so they have the built-in check, then add a hook that checks outbound requests for their emails and keys. Claude Code supports hooks, and the privacy mod itself uses a tool.check hook.

Test script-based requests too, and write down the hook's limits. This is a service idea, with no promise of income or complete protection.