Your AI Coding Assistant Isn't Reading Your Code, It's Mailing It Home
Hook An AI coding CLI that uploads your entire Git history — commit logs, secrets, and all — to a vendor-controlled bucket, and does it through a channel that your privacy opt-out doesn't even touch. That's not a bug bounty footnote. That's the exact threat model everyone waved off as "theoretical" a year ago, now confirmed with a canary file. This isn't new territory conceptually — "AI tool has overly broad file access" has been a known risk since the first VS Code extension asked for workspa
