{"version":"2.1.321","anchor":"email-guard-hook-now-denies-instead-of-asking-and-also-catc","canonical_anchor":"email-guard-hook-now-denies-instead-of-asking-and-also-catc","heading":"Built-in email check now blocks tool use instead of asking","tier":"notice","area":"Privacy","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321\/e\/email-guard-hook-now-denies-instead-of-asking-and-also-catc","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321","markdown":"### Built-in email check now blocks tool use instead of asking\n\nClaude Code's built-in email check now refuses a tool call carrying your email address rather than asking, and also spots the encoded form %40\n\n**What**\n\nClaude Code has a built-in check that looks at what Claude is about to send to a tool (a tool call is each time Claude uses one of its tools, such as running a command or fetching a page) and watches for an email address. Two things are different:\n\n- Decision: the check now refuses the tool call. It used to ask you whether to allow it.\n\n- Matching: it now treats `%40`, the way @ is written inside web addresses, as an @ sign. It used to look only for @.\n\n**Why**\n\nSending your email address in a tool call is now a hard block, and encoding the @ no longer gets around it.\n\n- Area: Privacy\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}