Taylor Edwards alleged in a November 5 GitHub issue that Claude Code sent a signed-in account email in an outgoing HTTP User-Agent header during web searches. A User-Agent is a field in an HTTP request. Edwards’s report concerns an outbound request to a third-party site, so a private repository setting does not govern what that request carries. Read the GitHub issue.
A repository’s privacy settings and an outgoing request header protect different things.
What Anthropic’s current privacy module checks
Anthropic’s current privacy-module README describes a tool.check hook that refuses certain Bash, PowerShell, or Monitor calls when their input contains both the account email and a User-Agent reference. The README says the match also covers case variations and percent-encoded email addresses. See Anthropic’s privacy-module README.
The README excludes WebFetch, WebSearch, and MCP calls from this hook. It also lists other ways a header could evade the check, including an address computed at runtime, a variable, a file or script, another client, or a different method of setting the header.
What can disable or override the hook
The current README lists plugin or settings controls and a server-side switch that can disable the check. An installed plugin’s overriding hook can take precedence, and the hook will not run in a session where registration fails. The README describes a safeguard with limited coverage, not a universal barrier against sending an email address.
What the release notes and reported tests say
Anthropic’s release notes for Claude Code v2.1.317, published November 3, say a check asks before a web or shell tool call sends the account email to the network. The current README describes a hook that refuses matching calls without prompting. These are distinct descriptions: the release notes name v2.1.317, while the README describes the current privacy module. Read the v2.1.317 release notes.
On November 7, Pasquale Pillitteri reported that two user tests in v2.1.318, one on macOS and one on Windows 11, did not trigger a block.
