QWE AI Academy Your email was in context on purpose. The leak was the missing gate
Key takeaway: Get on Claude Code 2.1.317+ (privacy check + built-in cc-plugin-privacy), confirm the mod is on, then treat WebFetch/WebSearch/MCP, bodies, and computed addresses as still open. “I updated” is triage, not closure.
Account email showing up in outbound requests isn’t mysterious telemetry. OAuth sessions already inject it so the model can attribute work. The failure mode was simpler: no hard network gate, so “bot etiquette” and retry-after-401 habits were enough for the model to paste that address into User-Agent strings. Instructions lost. A deterministic refuse path is what changed the odds.
What just blew up
Through late 2026, reports piled up of Claude account addresses appearing in HTTP User-Agent headers on traffic from web/shell tool use. One public thread described scam-mail floods after the address hit random third parties. Same skeleton each time: email already in session context; model treats “put a contact in the UA” as permission to use the account address.
Anthropic’s v2.1.317 release notes (around early November 2026 per the changelog window) call out a check aimed at web/shell tool calls that would send the account email. In the same line of work shipped the built-in privacy mod that hard-refuses a big slice of shell-style calls. Relief, plus a fair amount of “this never should have been soft-only.”
Method A vs Method B
| Approach | What you do | Pros | Cons |
|---|---|---|---|
| A – Bare update | Land on 2.1.317+, trust defaults | Fast; official path on by default | No proof the mod is live; gaps stay invisible |
| B – Update + verify + tighten | Update, check version/plugins, run one safe refuse test, optionally block email in more tool inputs locally | You see the gate fire; fewer surprise shapes | ~10-15 minutes |
If the address leaving the machine matters, B. A is fine for the first hour only.
Walkthrough: Method B
Do these in order.
1. Confirm and update
claude --version
claude update
# npm global install:
npm install -g @anthropic-ai/claude-code@latest
# Homebrew: brew upgrade claude-code
# WinGet: winget upgrade Anthropic.ClaudeCodeTarget: 2.1.317 or newer. Native installs may patch in the background; claude update forces it. Restart the session after.
2. Confirm the privacy piece is active
In an interactive session, open /plugin (Installed). You want the built-in privacy mod (cc-plugin-privacy) enabled. Defaults turned it on with 2.1.317+; if you disabled it earlier, turn it back on. Disable path, from the mods/privacy README: /plugin disable, or "cc-plugin-privacy@builtin": false under enabledPlugins in user, CLI --settings, or managed settings – not repo/project settings.
3. What the gate actually blocks
Silent refuse. No prompt. For Bash, PowerShell, or Monitor, if the tool input contains the account email (any case or simple percent-encoding) and names a User-Agent (or curl -A, wget -U, --user-agent, and similar), the call dies. Auto-mode allow rules do not clear it. The model gets told to retry without the address.
Pro tip: Two word-matches on purpose – no real parser. Fast seatbelt, not a vault. Expect some false refusals and misses on clever encoding.
4. Safe verification (don’t fertilize your real inbox)
Don’t aim a live UA+email curl at the public web. Draft the command, or point a throwaway task at a request bin you own, and watch whether both markers together trip a refuse on 2.1.317+. Nothing blocks on an older build? You’re not patched yet.
5. Optional wider net
UA-only shell coverage still leaves holes. If your threat model says so, add a local PreToolUse-style check in user settings (e.g. ~/.claude/settings.json) that fails closed when any tool input still contains your account email after simple case fold / URL decode. Keep the logic tiny. Wrong hook code is worse than no hook.
While you’re there: skim Claude Code data-usage docs (they cover training/retention and error redaction of email-like patterns – not the full UA story) and make sure git user.email isn’t quietly doubling as the account address in commits or $(git config user.email) expansions.
Edge cases the headlines skip
The built-in fix is real. Complete? No.
- WebFetch / WebSearch / MCP sit outside the shell UA check. Email can still leave on those paths if the model places it.
- Non-UA shapes pass: query string, JSON body,
From:header,curl -u, variables,$(git config user.email), script files, clients the word list doesn’t name. - False refusals: crude matching. Odd commands may get “retry without the address” noise; saved allows won’t override.
- UI quirks: some 2.1.318 reports said the plugin row wasn’t obvious under
/pluginsdespite the changelog. Believeclaude --versionplus a refuse test over the label alone.
Once the address is in context, “only if I ask” is still a soft preference. Site policies, auto mode, and long sessions push back. Hard checks win that fight.
FAQ
Does updating alone stop Claude Code from sending my email to websites?
On 2.1.317+ with cc-plugin-privacy left on, the common User-Agent-in-shell path is blocked. Other tools and non-UA shapes are not magically covered.
How did my email get into the model in the first place?
Subscription/OAuth login. Claude Code reads the account email from local auth state (commonly ~/.claude.json → oauthAccount.emailAddress) and injects a short userEmail block each session so work can be attributed. Later wording told the model not to ship it to unrelated services. Wording isn’t a firewall – which is why the client-side check had to ship.
Can I turn the privacy mod off, and should I?
You can: /plugin disable, or enabledPlugins false for cc-plugin-privacy@builtin in user/managed settings. Almost nobody should. The only coherent yes is a lab where you want contact mail in bot UAs and you accept third-party logs. False refusal? Change the command shape first. Don’t yank the seatbelt because one curl string looked like -user.
Next action: claude --version now. Below 2.1.317 → update, restart, /plugin, one controlled shell test that pairs your address with a UA marker, confirm the refuse. Then decide if you still want a broader email-in-any-tool block for your setup.