Claude Code put the account email in the model’s context; agents put it in User-Agent headers, and Anthropic is removing it

Claude Code has been putting the signed-in account’s email address into the model’s session context. When a site or API asked for a contact in the User-Agent header — SEC EDGAR, crates.io, Liquipedia, Wikipedia-style bot policies — the model sometimes supplied that email. Anthropic staff confirmed both the mechanism and a fix path on Hacker News on November 6, after the thread hit the front page.

What actually happens

This is not a hard-coded header on every web fetch. Claude Code injects a block roughly of the form “The user’s email address is …” into the context for OAuth-signed-in sessions (issue #81138 documents the construction site in the shipped bundle). Later prompt text told the model not to send that address to unrelated services unless asked. The model still sometimes did — for example a research subagent curling Liquipedia with -A "…(<user email>)" (#101659), or similar curls to crates.io and SEC.

The harness made the address available; the model decided to use it. Prompt-side “don’t send it” is soft. Anything in context can leave through a tool call, a commit, or a reply.

Lydia Hallie, who works on Claude Code at Anthropic, wrote on the HN thread:

Users had reported Claude would hallucinate names for things like @author tags, since it didn’t have context on the account. So we added the account email in the model’s context for signed-in users. But when Claude wrote a command itself, like a curl call, it sometimes put your email address in the User-Agent as a contact address.

She said Anthropic is removing the account email from the context in a release expected early next week, and apologized for not catching the behavior earlier.

What already shipped

Version 2.1.317 (November 3) added a built-in privacy check — referred to on HN as cc-plugin-privacy — that asks before a web or shell tool call whose input contains the account email. It is on by default; /plugins can turn it off. Hallie noted the stable channel was still on 2.1.311 at the time of her comment, so many users need to update to 2.1.317 or later for the check. She also said the check does not cover every case, for example when Claude writes a script and runs it itself.

We already covered other changes in that same 2.1.317 release (the rewritten game rule); the privacy check was one line in a long changelog and did not get its own story until the HN thread made the underlying leak clear.

Why it matters for agent harnesses

The interesting part is the split between context injection and deterministic gating. Putting identity in the prompt for authorship is a product choice. Relying on the model not to reuse that identity on the network is not a control. The interim fix is a string check around tool calls; the durable fix Hallie announced is to take the address out of context entirely.

Until that lands, the practical advice from Anthropic is: update past 2.1.317 so the ask-before-send check is present, and treat the upcoming context removal as the real close of the issue.