Watch the video, transcript and sources
+ Account email in the model's context, by design
+ Sites ask scripts for a contact in the User-Agent
- The model used your address; the guard covers one shapeYour login email is for logging in. For some signed-in Claude Code users, it also went out in the User-Agent header of requests to sites like Wikipedia and the SEC. Anthropic says it should have caught this earlier, and its own bug tracker shows how much earlier.
The address was there on purpose. Lydia Hallie, who works on Claude Code, explained on Hacker News that Claude kept making up names for things like @author tags because it didn't know who you were, so Anthropic added the account email to the model's context for signed-in users. A July report had already quoted the injected block: a # userEmail heading followed by "The user's email address is…". The same reporter caught Claude writing the address into git commits; GitHub's push protection blocked the push.
The other half is etiquette. Wikimedia's User-Agent policy says scripts should use an informative User-Agent with contact information or they may be blocked, and it accepts a website as the contact too. The SEC's EDGAR page shows a sample header with a company name and an admin email. When Claude wrote its own curl call, the only address in its context was yours. A Claude Code developer put it this way: "Claude apparently tends to decide that this policy is worth following."
Users quote the context itself telling the model never to send the address to an unrelated service "such as in a request header, URL, or payload" (#104774). One October report quotes Claude's own summary: "I sent it anyway." And a User-Agent doesn't vanish after the request: Apache's combined log format writes it into the access log.
Anthropic's first response shipped in version 2.1.317. The changelog calls it a check that "asks before a web or shell tool call sends your account email address to the network". A staff comment on the GitHub issue says it blocks the behavior, and the published readme says a Bash, PowerShell or Monitor call holding the address and naming a User-Agent is refused with no prompt. The test is two word matches, no parser, on purpose. The readme also lists what passes: WebFetch and WebSearch aren't checked, and neither are scripts that hold the address or values computed at run time. It calls the mod a courtesy that "covers one shape". Two users, on macOS and Windows, report the loaded mod didn't refuse their harmless tests; Anthropic hasn't confirmed that. The stable channel is still on 2.1.311, which doesn't have the check at all.
The fix that matters removes the input. Hallie says the next release takes the account email out of the model's context and should arrive "early next week". When I recorded this, the newest changelog entry was still 2.1.318. Until then: get off stable onto 2.1.317 or later, make any hooks of your own cover file writes and edits, and search your session transcripts for your own address next to a User-Agent.
How much earlier was it reported? On September 18, a user filed #95258, "User email from account metadata inadvertently sent to external service in User-Agent header". A bot labelled it area:security about a minute later. By late October at least four more issues described the same leak, to Wikipedia, the SEC and a gaming wiki. All five were still open on November 6. Anthropic says it noticed when the problem started spreading on Reddit.
Verdict: REVERT — an address the model can see is an address it can send
I'd revert putting the account email in the model's context. Anthropic plans to do exactly that; until it ships, the guard's own readme says it covers one shape.
Sources
Hacker News: Lydia Hallie on the cause and the planned removal · staff comment on site policies · thread
GitHub #81138 (July 25) · #95258 (September 18) · #102577 · #104774 · #101659
User tests: macOS · Windows (user reports)
Wikimedia User-Agent Policy · SEC: Accessing EDGAR data · Apache log files
npm: @anthropic-ai/claude-code (release channels)
Visual credits and use boundaries
Dario Amodei portrait: TechCrunch, CC BY 2.0, via Wikimedia Commons (Flickr source). Background removed, cropped and resized; identifies Anthropic only, with no endorsement, quote or reaction.
.jpg){kind=link}
UNO Draw 25 Cards (Imgflip template) and The Office via the official @theoffice GIPHY upload appear briefly as transformed narrator commentary. No actual reaction by anyone shown and no blanket reuse licence is implied; public hosting does not certify legal clearance.
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.