Most AI coding-tool security stories involve an attacker: a vulnerable editor, a poisoned package, a malicious build. This one doesn't. It's about something a tool does by design: put the signed-in user's email address into the AI model's context.
An open bug report on the Claude Code repository, issue #81138, filed on 25 July 2026 and still open when we read it on 1 November, describes it like this:
"Claude Code takes personal data I gave Anthropic in order to authenticate, and injects it into the model's system prompt on every session — automatically, without my consent, without disclosing that it does so, and with no supported way to stop it."
We checked this on a running Claude Code session on 1 November 2026, and the account email was there in the session's context, under a # userEmail heading. Nothing was hacked here, and nobody's account was compromised. The question is what an AI tool tells the model about you, and whether you get a say.
What the report says, and what has changed
According to the reporter, who read the shipped code, the address comes from the local login file and is added to the context the model sees. They point out that the only code path that skips it isn't a privacy setting, and that the neighbouring setting for project instructions does have a documented way to turn it off. In their words, the email has "no supported way to stop it."
It's also no longer a bare one-liner. A commenter on 28 August reported that in a later version "The string is still injected, but it now carries an instruction." In the session we checked, that instruction tells the model, in substance, to use the address only to identify the user and not to send it to an unrelated service unless the user asks.
That is a real mitigation, but it's worth being precise about what kind. An instruction asks the model not to misuse the data. It doesn't keep the data away from the model. The model still has it, and an instruction is only as reliable as the model's compliance on a given day.
What users report
The thread includes reports from users. These are their accounts, not confirmed by Anthropic, and no comment in the thread is marked as coming from a repository member:
- Two commenters, on 1 and 7 September, report that the agent changed their Git settings to commit under the account email, without being asked.
- A commenter on 22 October reports that in version 2.1.289 the block appears on every request the tool sends to the model, not just once per session.
- A commenter on 27 October reports that a subagent (a helper the main agent starts for a sub-task) gave their email to a web service, and that they now use a hook to try to block it.
That last point matters beyond this one tool. When an agent passes its context to the helpers it starts, whatever personal data is in that context goes with them.
What to ask about any AI tool you sign in to
This is one open issue in one product, but the questions apply to every agentic tool you or your team authenticate to:
- What of my identity goes into the model's context? Email, name, organisation, account IDs. If the documentation doesn't say, ask.
- Do helper agents inherit it? If the tool spawns subagents or runs tools that make web requests, assume they can see what the main agent sees.
- Is there an off switch? "There's an instruction telling the model not to misuse it" and "it isn't sent at all" are different answers. For a company handling client data, that difference is a procurement question.
- What can it send out? Tools that make web requests are where data in the context can leave. Know which ones are enabled, and consider allow-lists or hooks that block outbound requests you didn't expect.
- Pin down what you don't want changed. If you care which identity your commits use, set Git's user details explicitly per repository, and review commits made by an agent before pushing.
None of this requires panic. It requires knowing what your tools put in front of the model, because anything in the model's context is something the model can repeat.
Source: anthropics/claude-code issue #81138, "[BUG] Account email (PII) is injected into the model's system prompt without consent, disclosure, …" (opened 25 July 2026, open as of 1 November 2026), and its comments, read 1 November 2026. User reports are attributed to their dates and are not confirmed by Anthropic.