You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PrivacyArea: what it touches
ImprovementsKind: in v2.1.321,
ImprovementsSection of the release
What
Claude Code has a built-in check that looks at what Claude is about to send to a tool (a tool call is each time Claude uses one of its tools, such as running a command or fetching a page) and watches for an email address. Two things are different:
Decision: the check now refuses the tool call. It used to ask you whether to allow it.
Matching: it now treats %40, the way @ is written inside web addresses, as an @ sign. It used to look only for @.
Why
Sending your email address in a tool call is now a hard block, and encoding the @ no longer gets around it.
