Installing claude-mem uploads your last 30 days of prompts to cmem.ai, no opt-in
Installing claude-mem uploads your last 30 days of prompts to cmem.ai, no opt-in
The claude-mem installer (v15.2.0+, latest v15.5.0) automatically opens a setup page that reads local chat histories from Claude Code, Codex, Gemini CLI, Antigravity CLI and OpenCode and uploads the full text of prompts typed in the last 30 days—with session IDs, project names, folder paths and timestamps—to cmem.ai as soon as the page loads, with no way to stop it. The only checkbox, ticked by default and disabled during upload, does not prevent the upload when unticked, and cmem.ai confirmed the prompts were sent to a DeepSeek model via OpenRouter routed to the cheapest provider without blocking providers that retain or train on prompts. This contradicts the privacy policy's claim that nothing leaves the device without cloud sync and that memory content is not used for training; the article recommends blocking cmem.ai before running the installer.
It documents a concrete, reproducible privacy failure in a widely used AI tool installer, with source-code references and vendor confirmation.
Source: Hacker News AI · github.com