Anthropic plans to remove account emails from Claude Code context Anthropic plans to remove account emails from Claude Code context

Identity became request data

The reports describe a failure between identifying a user and identifying an automated client to a website. In the October 29 account, a research subagent supplied the signed-in email when constructing a government-data request. It already had that address in session context. The destination received a command-generated request carrying information that the user expected to remain inside the assistant. A request header is part of what the remote service receives, even when the visible task is simply downloading public material.

Reports preceded the latest complaint

The November 5 GitHub complaint identifies Claude Code 2.1.318 on macOS and says an account email went to third parties during web research. An earlier October 29 report describes 15 requests across four projects using version 2.1.312. That reporter says research subagents included the address while downloading government data, despite a session instruction against sending it to unrelated services. These reports describe agent-written requests, making the generated command part of the privacy question rather than just the browser or search interface.

The shipped check has a narrower job

The official 2.1.317 release notes, dated November 3, document a check that asks before web or shell calls send the account email over the network. The public privacy module describes a more specific mechanism: inspect tool input for the account address together with a User-Agent marker. Its listed tools are Bash, PowerShell and Monitor. The module refuses matching calls and tells the model to try without the address. It deliberately uses text matching instead of parsing a complete program.

Context removal and network control differ

That module’s documentation lists gaps, including addresses assembled at runtime, scripts and files, and tools outside its checks. The distinction matters for agent developers: removing an unnecessary identity field reduces one source of personal information available for generated commands. Inspecting outgoing actions addresses where information can go after an agent obtains it. Those controls operate at different points. The documented module targets one recognizable request shape; its own description does not offer a general guarantee against personal-data transmission.

A version number is only part of the record

The November 6 release notes for version 2.1.319 include changes to automatic permission handling, including a setting that denies calls instead of waiting for a prompt. They do not announce the promised removal of account email from model context. That gives teams two separate items to track: the installed release and the behavior of the request path they actually use. A command generated in a subagent, a direct web tool and a script launched later are distinct execution paths.