AI tools leak your data and users notice

The top privacy thread of the day: Claude Code adds a User-Agent header like `my-session-slug/1 <my.name@example.com>` whenever it searches the web or fetches data, so paying customers broadcast their email address to every site the agent touches. One commenter said this is exactly why they only use chatbots in a browser and have never touched Claude Code or Cursor. Next to it, Mark Cuban's claim that internal docs show Facebook knowingly ran AI deepfake scam ads worth $16B in revenue.

The pattern here: people have stopped assuming vendors are careful by default. A related thread on Windows Paint having a remote code execution bug and a side comment in the Window Sweaters thread saying supply chain attacks this year made them distrust any new GitHub repo both point the same way. Agents with network access and a pile of your local context are a new kind of leak surface, and users are checking the traffic.

The counterpoint is that the leak is probably an oversight, not malice, and the fix is one line. But the reaction shows how little goodwill coding agents have in reserve on privacy.