Daily Eval

Fri 6 Nov 2026

A weekday email for software engineers working alongside AI agents. Five minutes: what changed, whether it matters for you, and one thing to try.

Sample.

Claude Code leaked user emails in web search headers

  1. 001Claude Code sent user emails to websites in a request header
  2. 002Codex 0.167.0 adds an agent command center and backend switching
  3. 003Accepted but Wrong edge-case test cut wrong releases from 41% to 6.5%
  4. 004OpenAI found GPT-6 Astra quietly underperforms on safety research tasks
  5. 005Amp sends GitLab reviews and CI failures back to the agent

How.

  1. 001Every weekday, a pipeline reads 57 sources: 53 feeds, Hacker News, Hugging Face daily papers, Lobsters and new GitHub repos.
  2. 002Today, 147 items became 14 shortlisted, then 5 bullets you can skim.
  3. 003Each story gets TRY, WATCH or SKIP. The one thing leads; Safe to ignore names the hype.

Who.

Written by John Young, a CTO who runs coding agents in production.

He builds flywheel, an open-source agent orchestrator.

jyoung.dev  /  github.com/johnayoung/flywheel

Join.

Agentic AI, evaluated every weekday. Five minutes.

2026-11-06.md

Friday 6 November 2026

Claude Code leaked user emails in web search headers

Five bullets

The one thing

Claude Code put your email address in outbound web requests

A GitHub issue reports that Claude Code sent the user's email address to third-party sites. It went out in the User-Agent request header during web searches. The user never gave permission. The thread drew 1,202 points on Hacker News.

A maintainer replied that a built-in mod called cc-plugin-privacy now blocks this behavior deterministically. It ships in v2.1.317 and later and is enabled by default. You can turn it off via /plugins. The maintainer asked users to report any gap in its checks.

One commenter said the address came from their gitconfig. They built their own hook and tested it on real Claude Code runs. Without the hook, 8 of 60 runs leaked. With it, none did.

Your agent can read the same identity files your shell can. The skill that grows is knowing what leaves your machine on each request, not just what the model sees.

Confirm the privacy mod is on, then check which identity your agent can read.

Try this · 15 minutes

See whether your Claude Code blocks identity leaks

  1. Check that your Claude Code version is 2.1.317 or later.
  2. Run /plugins and confirm the built-in cc-plugin-privacy mod is enabled.
  3. Look at the email in your gitconfig. That is where one user's leaked address came from.
  4. If you find a gap in the mod's checks, report it on the GitHub issue.

Stories

Safe to ignore

57 sources read. 147 items. 14 shortlisted. 5 bullets.