I've 100% seen it do this. I've even seen Claude say "because your account email is <email>, I've included it in the <whatever it was doing>". It should ask before divulging information like that, IMO.

I can confirm that Opus on the web once generated a CURL that used my email as the user agent string. Though I did not see any issue with that and used the command it offered as is.