News · 2026-11-06

Claude Code put account emails where generated requests could expose them

Claude Code put users’ account email addresses in the model’s context, and the model could include an address in an outgoing request header. Anthropic acknowledged the behavior and said it planned to remove the email from context; a previously shipped confirmation guard has documented coverage limits.

Key facts

• A November 5 report named Claude Code version 2.1.318.
• Anthropic added a confirmation check in version 2.1.317, according to its release notes.
• The published privacy mod excludes several tool paths and lists bypasses.
• Primary source: the Claude Code issue and Anthropic’s contributor explanation.

The issue is a practical example of how information given to an assistant can migrate into an action. In the Hacker News discussion, an Anthropic contributor explained that Claude could use the account address as contact information in a generated curl command. The intention behind putting it in context was to help with identity-dependent work such as “@author” tags. The contributor apologized and said the behavior should have been caught earlier.

Think of the model’s context as a desk covered with useful papers. A person drafting a letter may pick up a return address from the desk even though the owner never meant it to go to that recipient. Here the model generated the request; the evidence does not show a networking layer automatically attaching the address to every request.

Earlier reports help establish the timeline. Issue 81138 describes a userEmail field in the version 2.1.220 bundle. Issue 98584 reports repeated reproduction against a test site. These observations do not constitute a complete version-by-version audit or an independent packet-level investigation of every report.

Anthropic’s release notes say 2.1.317 added a check before a web or shell tool call sends the address to the network. A contributor said the privacy mod is enabled by default. Yet its published README describes checks for selected shell-style calls and explicitly excludes WebFetch, WebSearch and MCP. Values computed at runtime or passed through files and scripts can also evade its listed checks. Those limits make the guard useful but not a complete boundary.

The reporter linked subsequent scam emails to the exposure, but the issue does not establish causation. Anthropic’s planned removal of the field would address the source of this particular exposure more directly. The broader lesson is that information-flow control must cover what an agent can see as well as the tools it can call.

The distinction between data in context and data in a request is also important when assigning responsibility. A model might be asked to visit a website for an entirely legitimate task, and a site might ask automated clients to identify a contact. Neither fact automatically means the user chose to disclose a personal account address. The critical transition is the model's decision to copy information from its available context into a tool argument that reaches a third party.

A confirmation prompt can help when it sees that transition. But checking the text of selected tool calls is different from inspecting every final network request. An address can be assembled by a script, read from a file, or passed through a tool that the check does not cover. The published guard itself identifies such limitations. The report therefore gives security teams a concrete reason to inventory tool paths and data sources, rather than assuming that a single check covers all routes.

The historical reports should also be read separately. A bundle excerpt documenting a context field shows that information was present in that version; an issue describing a generated command reports a particular behavior; and the later user report names another version. Together they support a plausible mechanism over time, but none establishes that every user experienced the same disclosure. Nor does a default-on safeguard prove that it successfully caught the reported 2.1.318 case; the issue as described does not include a complete reproduction that resolves that question.

Anthropic's announced removal would reduce the chance of this particular address being copied by removing it from the model's working material. It would not, on its own, establish that every other sensitive value in every agent session is protected. The general operational question is which information an agent actually needs for the task, and what independent checks apply when it sends data outward.

Primary source, verified: read the paper →

Ground Truth. (2026, November 6). Claude Code put account emails where generated requests could expose them. Ground Truth. https://groundtruth.day/news/claude-code-account-email-network-headers.html

@misc{groundtruth:claude-code-account-email-network-headers,
  title  = {Claude Code put account emails where generated requests could expose them},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {nov},
  url    = {https://groundtruth.day/news/claude-code-account-email-network-headers.html}
}

Topics: cybersecurity · ai-security · privacy · agents