Claude Code Is Normalizing Data Egress

The scandal is not that developers are using Claude Code. It is that they see a terminal on their own machine and start acting like the work is staying there.

People think they are talking to a local coding tool. They think their Mac mini is doing the thinking. In practice, they are often feeding a remote model provider a live stream of their work, context, and mistakes. That is the part of the conversation that keeps getting softened by interface language. Claude Code looks local because it runs in a terminal. That does not mean the reasoning is local. It definitely does not mean the confidentiality boundary is local.

Anthropic's own documentation says that, in order to interact with the model, Claude Code sends data over the network, including all user prompts and model outputs. That should be the front door to the conversation. A terminal interface is not a privacy boundary. It is a user interface.

You are not keeping your dealings local. You are disclosing them to Anthropic's systems, and sometimes to whatever other systems Claude Code can reach. A desktop wrapper does not make a remote model local. A shell does not turn an API call into on-device inference.

That breaks into three facts.

First, anything you paste, ask, or cause the tool to emit as prompt or output goes over the network. That is true even when some execution happens locally. The distinction people think they are making is usually "this is on my machine." The distinction that actually matters is "who can see the material." Compute locality and confidentiality are not the same thing.

Second, Claude Code can read broadly by default, and users can allow shell commands, edits, and wider tool access. Anthropic's own settings and security documentation is much more sober than the discourse around the product. It tells users to deny reads to sensitive paths like `.env` and secret-bearing directories. It exposes allow rules, ask rules, deny rules, wider working-directory access, and a bypass-permissions mode. Anthropic is explicit that dangerous bypass modes should be used only inside isolated containers or VMs, and equally explicit that even a container does not prevent a malicious project from exfiltrating what is reachable inside it, including Claude Code credentials. Again, the interface feels local. The reachable surface is much larger than that feeling.

Third, MCP expands the blast radius from "my repo" to "my connected tools and data sources." Anthropic presents MCP as the path to databases, APIs, issue trackers, monitoring systems, chat tools, and workflow software. Anthropic also warns that third-party MCP servers are not managed or audited by Anthropic and can expose users to security and prompt-injection risk, especially when they fetch untrusted content. At that point the privacy question is no longer "does my code leave my machine." It is "what exactly have I allowed this agent to see, traverse, and relay through a system that is still fundamentally networked."

This is where the article needs precision. The problem is not that everything you put into Claude Code is automatically used to train Anthropic. That would be false.

What matters is that training and disclosure are different questions, and developers keep collapsing them into one.

On consumer Claude plans, Anthropic says chats and coding sessions may be used to improve models if the user allows model improvement, if the session is flagged for safety review, or if the user explicitly opts in through things like feedback or testing programs. Anthropic also says retention periods differ depending on those settings. On commercial terms, Anthropic says Claude Code prompts and code are not used for generative model training by default unless the customer explicitly provides data for model improvement. That is a meaningful difference. It does not erase the disclosure. It changes one downstream use of that disclosure.

That is why the training argument, while real, is too small to carry the whole piece. Training is only one part of the risk. The bigger issue is that developers are casually routing personal, operational, and company information into a privileged networked agent under rules most of them have not actually read.

Telemetry adds another layer of collection that gets overlooked for the same reason. People talk as if the only relevant audience is Anthropic itself. Anthropic says default Statsig telemetry does not include user data like code or file paths, which is narrower than the inference path. But Anthropic also documents an OpenTelemetry pipeline for Claude Code that organizations can wire into their own observability stack. Prompt content is redacted by default, but operators can enable prompt logging. Tool activity can include file paths and bash commands in tool parameters. So even if someone wants to narrow the conversation to "Anthropic is not training on this by default," that still leaves a separate data-collection and disclosure story inside the organization itself. The terminal may be yours. The logs and transport path may not be.

Remote modes need the same clarity. Anthropic says Remote Control keeps execution on your machine while routing session traffic through Anthropic's API. Anthropic separately says Claude Code on the web runs inside Anthropic-managed virtual machines. Those are different trust models. They should not be discussed as though they are interchangeable simply because the product name is the same. "I used Claude Code" does not tell you whether the inference was local, remote, hybrid, or web-hosted. It tells you almost nothing about the actual data path.

The category error is broader than Claude Code. Developers are increasingly treating interface continuity as if it implied security continuity. It does not. A terminal does not make a networked system private. A desktop app does not prove on-device inference. Local execution does not make a vendor boundary disappear. A pleasant permission prompt does not make the reachable surface small.

None of this means never use Claude Code. It means stop describing it as though it were a harmless local coding utility. It is a privileged, networked agent. Sometimes that trade is worth making. Sometimes it is absolutely not.

The sane default is precision. If you would not willingly disclose the material to a remote provider, do not place it behind a consumer Claude Code account and pretend the terminal changes the fact pattern. Do not let "runs on my laptop" substitute for "stays on my laptop." Deny reads to secret-bearing paths. Keep third-party MCP off until reviewed. Do not use bypass-permissions modes outside a hardened sandbox. If the data actually matters, use enterprise controls or provider routes whose terms you deliberately chose.

The revealing part is not that developers are using AI. That part is normal. The revealing part is how quickly they normalize third-party disclosure of sensitive context while talking about a terminal UI as if it proved local execution, and then talking about local execution as if it proved confidentiality.

That is the real privacy story. Not that all your data is gone. That you are disclosing more than you think, to more layers than you think, under rules most people have not actually read.