As long as the email is in the context, which it is IIRC, it can totally decide to run curl –H 'User-Agent: <your email blah blah>'. You need to have a pretty poor understanding of LLMs to think this is a deterministic problem of reading user agent builder source code. Unless you found explicit filter code that blocks the behavior, that is. LLM info leaks to third parties mostly aren’t deterministically coded behavior.

Edit: I’m not completely sure if Codex injects email into system prompt (not at the computer, can’t check, but IIRC the model does know my org domain), but even if it doesn’t, it will be in the context as soon as it makes a git commit anyway.