You ask Claude Code to look up public documentation. The agent prepares an HTTP request and writes a User-Agent containing the email address tied to your signed-in account. The destination site receives that header alongside the requested URL. This is not exposure of your entire repository, but it can disclose personal information you did not intend to send. A report opened on November 5 in the official Claude Code repository describes this behavior; mitigations and limitations were discussed on November 6.

What is established, and what is not

The issue is labeled security-related and describes a case on Claude Code 2.1.318. In the discussion, project contributors explained that the signed-in email had been added to model context to avoid invented attributions. When Claude wrote a command such as curl, it sometimes reused that email as a contact in the User-Agent. Anthropic published the source of a privacy mod intended to block shell calls that contain both the account email and a User-Agent header. The team says it is enabled by default in 2.1.317 and later.

That is not a complete root fix. A response attributed to a Claude Code team member says removing the email from model context is planned for a later release. It also acknowledges that the mod does not cover every route, such as a script the agent writes and then runs. Several users reported tests in the issue where the mod appeared not to block the expected case. Those are third-party reports that SoyJB has not reproduced, not a measure of how widespread the issue is. As of our November 7 review, we did not find an official release note confirming that the context-removal fix had reached everyone.

A practical checklist for Claude Code users

1. Check your version with claude --version and inspect the official release notes. Updating to a version with the mod can add a barrier, but a version number alone does not prove the risk is gone.
2. Before approving agent-generated network commands, inspect the destination, headers, and options such as curl -A. If your personal email or a sensitive project name appears, stop the call. Use an approved institutional contact identifier where a site requires one, or obtain the information another way.
3. For sensitive client work, temporarily restrict autonomous web requests and inspect scripts Claude writes before running them. A project instruction can guide the model, but it is not a technical control on outbound data.
4. To investigate past exposure, review local tool histories and network logs under your team's policies. Do not upload those files to a public analyzer; they may include tokens, paths, or customer information. If you identify a real third-party request, record the domain, time, and type of data without reposting the email in a public ticket.

Be precise about evidence: finding User-Agent text in a log does not itself prove a request was sent. A blocked command or local test can leave a trace. Verify execution and destination. Nor can unwanted email be attributed to this behavior without independent evidence.

The broader lesson for coding agents

An agent can reuse data from its context in an external tool even when the user only asked it to research. Stronger defenses minimize the data available to the agent, constrain permissions and outbound requests, and confirm a root fix through release evidence. The Claude Code team has said it will remove the email from context. Until the release and its scope are verified, treat the current mod as a partial safeguard.

Sources: Claude Code issue, opened Nov 5, 2026; privacy-mod source, Nov 6, 2026; official releases. Status reviewed Nov 7, 2026. SoyJB did not reproduce the request or measure the number of affected users.