# Claude Code Now Asks Before Sending Your Email Online > Claude Code 2.1.317 (3 Nov 2026) asks before a web or shell tool call sends your account email to the network. What changed and what teams should do. Canonical: https://bridge-terminal.com/atlas/blog/claude-code-asks-before-sending-account-email/ Last updated: 2026-11-06 Published 6 November 2026 · Plain English · What's new · 5 min read ## The short version - Claude Code 2.1.317, listed in the changelog on 3 November 2026, added a check that asks before a web or shell tool call sends your account email address to the network. - The release note is one line. It does not say how often the question appears or what happens in runs where nobody is watching, so test it on your own setup. - The change is about a small, quiet leak: your sign-in identity travelling inside a request the agent makes. It is not about your source code. - If you use Claude Code through other software, update it, decide who answers the prompts, and keep the agent's internet access narrow. Claude Code now asks you before a web or shell tool call sends your account email address to the network. Anthropic added this check in version 2.1.317, listed in its changelog on 3 November 2026. It is a small change, but it touches a question many teams ask: what leaves my machine when an AI agent works? This article explains what the change is, what the release note does and does not tell us, and what a team should do about it. ## What changed in Claude Code on 3 November 2026? Claude Code is Anthropic's coding agent. It reads your project, runs commands and edits files, and it can also reach the internet. It does that through "tools": a web tool that fetches pages, and a shell tool that runs commands on your computer, such as downloading a file. Version 2.1.317 added this line to the changelog: "Added a check that asks before a web or shell tool call sends your account email address to the network." In plain words: if one of those tool calls is about to send the email address you signed in with out over the network (the internet or your company's network), Claude Code is meant to stop and ask you first. The note does not say whether the email was being sent before in some cases, so we do not claim that it was. ## Why would an email address leave your machine at all? The release note does not say. It gives no reason and no example, and we did not find a fuller explanation from Anthropic. So we will not guess at the cause. What we can say is why the question matters in general. An agent that browses and runs commands builds requests, and requests can carry details about who you are. Your sign-in email is one such detail. If it went out inside a request to some website, the site's owner could learn who is using the tool, and you might never notice. That is different from your code being shared. This change is about identity, not source files. ## Is this the same as prompt injection? Not quite, but they are neighbours. Prompt injection is when hidden text in a web page or file tricks the agent into acting against you. Anthropic's security documentation describes it as an attacker inserting malicious text to override or manipulate the assistant's instructions. One thing an attacker might try is to get the agent to send private details to an outside address. The release note does not link this check to prompt injection, so we do not claim that is why it exists. It is still the kind of guard that helps there: a question appears before something personal leaves, so a person gets a chance to say no. ## What does this mean for a team? For most teams, the practical effect is one more prompt, now and then. Three things are worth knowing. ### Someone has to answer the question A prompt only protects you if a person reads it. If your engineers click through every prompt without looking, the check adds little. Agree on a simple rule: an email address going to an address nobody recognises is a "no" until someone explains it. ### Runs with nobody watching are different Many teams run Claude Code unattended, overnight or in automated pipelines. The release note does not say what the check does when no one is there to answer. It may wait, refuse or behave some other way. Do not assume. Run a small test in your own setup and see what happens before you rely on it. ### Keep internet access narrow in the first place A question is a safety net, not a wall. Claude Code's security documentation says that commands that fetch content from the web, such as curl and wget (two common download tools), are not auto-approved by default. In manual mode, where Claude Code asks before it edits files or runs commands, they prompt like any other command that is not read-only. The same page says that in that mode most tools that make network requests need approval by default. The documentation also describes two ways to go further. You can add a deny rule, which stops Claude from running those commands at all. A deny rule matches the command as it is written, so it can be sidestepped by a differently worded command. For a stronger limit, use the sandbox's network isolation. A sandbox is a walled-off space for commands, and its network limit does not depend on how a command is worded. The fewer places an agent can reach, the fewer places an email address can go. ## How do I get the change? Update Claude Code to version 2.1.317 or later. The changelog also lists 2.1.318, dated 4 November 2026. Its entry does not mention the email check, but a later version should carry it forward. If someone on your team uses Claude Code through another tool, ask them which version they actually run. Updates reach different setups at different speeds. ## Where Atlas stands Atlas is a software team made of AI engineers, built on Claude Code. It runs Claude Code in the terminal, signed in with your own Claude plan, so its engineers get whatever Claude Code does. Atlas has no feature of its own for this email check, and it does not show you, in one place, what an engineer's tool calls send out. A plain view of that is coming to Atlas, built in, so it needs no setup on your side. Until then, here is what Atlas already does around it. It never decides for you to send anything outside. Secrets pasted into chat go to a secret store first. Atlas also shows each engineer's live activity on its Network screen. For the email check itself, rely on Claude Code's own behaviour and test it as described above. You can read more on the [Atlas home page](https://bridge-terminal.com/atlas/). ## A short checklist - Update Claude Code to 2.1.317 or later. - Decide who answers permission prompts, and what they should refuse. - Test what happens in an unattended run before trusting it. - Deny or sandbox network commands you do not need. - Keep a short note of what you tested and when, so the next update is easy to recheck. ## Conclusion The change is one line in a changelog, and its details are thin. It does add a useful pause: before your account email goes out in a web or shell request, Claude Code asks. Treat it as a good habit, not a guarantee. Update, test your unattended runs, and keep the agent's reach onto the network as small as the work allows. ## Questions people ask ### Does Claude Code send my email address to websites? Anthropic's 3 November 2026 release note says Claude Code now asks before a web or shell tool call sends your account email address to the network. The note does not explain when or why such a send would happen. ### Which Claude Code version added the email check? Version 2.1.317, listed in the changelog on 3 November 2026. Version 2.1.318, dated 4 November, does not mention it in its own entry, but a later version should carry the check forward. ### Does this check work in automated or overnight runs? The release note does not say. Test it in your own setup before relying on it. Keep network access narrow with deny rules or the sandbox's network isolation, which does not depend on how a command is worded. ### Does this stop Claude Code from sharing my code? No. The check is about your account email address in web or shell tool calls. It says nothing about source code, which is a separate question. ### Does Atlas have its own version of this check? No. Atlas runs on Claude Code, so it gets Claude Code's behaviour, but it has no separate feature for this email check. A single view of what engineers send out is coming to Atlas, built in, with no setup needed. ## About Atlas: What Atlas does around outgoing data today Atlas engineers run on Claude Code under your own Claude account, so they work with whatever Claude Code does. Atlas never decides to send anything outside for you, and secrets pasted into chat go to a secret store first. A plain view of what each engineer sends out is coming to Atlas, built in, with no setup. Until then, update Claude Code and test unattended runs. — https://bridge-terminal.com/atlas/ ## Sources - [Claude Code changelog (version 2.1.317, 3 November 2026)](https://code.claude.com/docs/en/changelog) - [Claude Code CHANGELOG.md on GitHub (2.1.317 entry)](https://raw.githubusercontent.com/anthropics/claude-code/refs/heads/main/CHANGELOG.md) - [Claude Code security documentation](https://code.claude.com/docs/en/security) _Researched and drafted with Claude, then checked against the sources above. Atlas is an independent product, not affiliated with Anthropic or OpenAI._ ## Related - [Prompt Injection Explained: A Plain Guide for Founders](https://bridge-terminal.com/atlas/blog/prompt-injection-plain-guide-ai-coding-agents/) - [Claude Code Now Warns 10 Days Before Your Login Expires](https://bridge-terminal.com/atlas/blog/claude-code-login-expiry-warning-unattended/) - [How to Write a Spec With an AI Coding Agent (No Code)](https://bridge-terminal.com/atlas/blog/write-spec-with-ai-coding-agent-plain-guide/)