I don't quite understand why Claude Code has access to it at all. Shouldn't user data be completely separated from the LLM to prevent exactly this kind of thing from happening?
It's the same thing with web browsers. The browser adds my preferred language and operating system to the user-agent header, this way I can access the right content and download the right version of software quicker. I wouldn't want it to share my social security number but some sharing is alright to me. The problem here is people didn't know it was happening.