Claude Code was putting users' account emails into model context; a new check now asks before sending them out

Anthropic's Claude Code changelog for version 2.1.317 adds a check that asks before a web or shell tool call sends your account email address to the network. That line sits on top of months of user reports that the signed-in email was being injected into the model's context and sometimes reused on the way out.

What was going wrong

When you sign in, Claude Code stores account details locally. A user-filed issue says the email from that store is added to the model's context at the start of each session. The model was never told to keep it quiet.

Two open issues describe the leak in the wild: a subagent putting the user's email in a User-Agent header, and the same pattern on Wikipedia requests. The behaviour fits a common API habit — some sites ask clients to put a contact address in User-Agent — and a model that can see your email will helpfully fill it in.

How often it happened is unclear. One site operator reportedly found no cases in about ten million log lines. Rare is not the same as safe: one hit still leaves your address in someone else's logs, and a prompt-injected page can ask the agent to include a contact email on the next request.

What 2.1.317 changes

A web or shell tool call that would send the account email to the network now stops and asks first. That is a gate outside the model. It does not, by itself, stop the email being added to context, and it only helps if someone reads the prompt — bypass mode and unattended jobs can still skip it.

Follow-up coverage notes Anthropic has said it will remove the email from context in a later release. Until then, the prompt is the main defence shipping today.

Our take

Agents carry more of your identity than you notice: email, paths, usernames, repo names. Don't trust the model to keep quiet about data it can see. Put a gate outside the model, use a throwaway account for risky work, and update past 2.1.317.