Claude Code fabricates GitHub usernames in PR comments, potentially leaking private information to external users

Summary

When asked to add a PR comment mentioning the PR author, Claude Code fabricated a GitHub username instead of looking it up with the available gh CLI tool. The fabricated username belonged to a real external GitHub user. This potentially caused GitHub to send a notification email containing private repository comment content to an unrelated person.

Steps to Reproduce

1. Ask Claude Code to review a PR on a private repository and add comments. Refer to the PR author by first name (e.g., "add a comment asking Bob if he thinks the frontend needs to handle this") without specifying their GitHub username
2. Claude Code guessed a GitHub username from the author's first name and the branch name prefix instead of running gh pr view <number> --json author to get the actual username
3. The fabricated username belonged to a real GitHub user outside the organization
4. A PR comment containing internal implementation details was posted with the incorrect @-mention

Potential Impact

• The fabricated @-mention may have triggered a GitHub notification email to an external user containing private repository comment content (internal enum names, app names, implementation discussion)
• It is unclear whether GitHub sends notifications to @-mentioned users who do not have access to a private repository — GitHub may suppress these notifications, but this is not confirmed
• If the notification was sent, deleting the comment from the PR would not recall the email
• The affected repository is private, so this content was not otherwise accessible

Expected Behavior

Claude Code should never fabricate identifiers that trigger external side effects. When @-mentioning a user in a PR comment, it should verify the username using available tools (e.g., gh pr view --json author) before posting. This falls under the category of "actions visible to others" that the system prompt already instructs Claude to handle carefully.

Environment

• Claude Code CLI
• Model: Claude Opus 4.6