{"id":"TECH-202610-claude-mem-installer-v15-2-0-silently-uploads-the-last-30-da","kind":"technique","aliases":[],"related":[],"title":"claude-mem installer (v15.2.0+) silently uploads the last 30 days of Claude Code, Codex, Gemini CLI and OpenCode prompts to cmem.ai, which passes them to unknown LLM providers","description":null,"summary":"Running 'npx claude-mem install' interactively with installer v15.2.0 or later (still the case in v15.5.0, released 2026-10-29) opens a browser setup page. As soon as the page loads, it reads the local chat history of the last 30 days from Claude Code, Codex, Gemini CLI, Antigravity CLI and OpenCode, whichever tools you picked. It uploads the full prompt text to cmem.ai along with session IDs, project names, folder paths and timestamps. You cannot stop the upload. The only checkbox is ticked by default and greyed out during the upload, and unticking it does not stop it (confirmed by cmem.ai). cmem.ai says it sent the prompts to a DeepSeek model through OpenRouter, routed to the cheapest provider, without excluding providers that keep or train on data, and it cannot say which provider got them. This contradicts its privacy policy ('nothing leaves your device unless you explicitly turn on cloud sync'). Developers whose prompts contained secrets, internal code, customer data or project names may have leaked them to third parties. The upload is mentioned only in the v15.2.0 changelog (2026-10-25). Reported in GitHub issue #5176. No attacker involved: this is data exposure by the vendor's own installer.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"claude-mem","fixed":[],"affected":">= 15.2.0","ecosystem":"npm"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"- Check whether anyone ran 'npx claude-mem install' with installer v15.2.0 or later (from 2026-10-25): run 'npx claude-mem --version' or look at the plugin version in the Claude Code plugins directory.\n- Look in proxy, DNS or EDR logs for traffic from developer machines to cmem.ai, especially right after a claude-mem install.\n- Check whether the prompts in ~/.claude/projects, ~/.codex/sessions, ~/.gemini and ~/.local/share/opencode from the 30 days before the install contained secrets, credentials or confidential data.","fix":"- Block cmem.ai on developer machines and networks before anyone runs or reruns the claude-mem installer, or ban claude-mem until the setup upload is opt-in.\n- If someone already ran the setup, treat any secrets typed into agent prompts in the 30 days before the install as exposed, and rotate them.\n- Ask cmem.ai to delete the install's data. Copies at OpenRouter or the downstream model provider are not covered by that deletion.\n- Turn off claude-mem telemetry ('npx claude-mem telemetry disable') and check whether the CMEM Pro or cloud provider is set as the default.","status":"open","published_at":null,"first_seen_at":"2026-10-29T14:28:32+00:00","triaged_at":"2026-10-29T14:28:32+00:00","updated_at":"2026-10-29T14:28:32+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-0':38A '-10':77B,240B '-202610':31A '-25':241B '-29':78B '2':37A '2026':76B,239B '30':10A,44A,99B '5176':246B 'along':123B 'antigrav':107B 'attack':248B 'browser':81B 'cannot':134B,189B 'case':72B 'changelog':238B 'chat':94B 'cheapest':176B 'checkbox':140B 'claud':2A,13A,61B,102B 'claude':33A,47A,52A 'claude-mem':1A,46A,51A,60B 'claude-mem-installer-v15':32A 'cli':17A,106B,108B 'cloud':209B 'cmem.ai':22A,122B,160B,161B 'code':14A,103B,217B 'codex':15A,104B 'confirm':158B 'contain':214B 'contradict':196B 'custom':218B 'da':45A 'data':186B,219B,252B 'day':11A,100B 'deepseek':169B 'default':144B 'develop':211B 'devic':203B 'earli':55B 'early-warn':54B 'exclud':179B 'explicit':206B 'exposur':253B 'folder':129B 'full':118B 'gemini':16A,105B 'github':244B 'got':193B 'grey':146B 'histori':95B 'id':126B 'instal':4A,63B,66B,259B 'installer':35A 'interact':64B 'intern':216B 'involv':249B 'issu':245B 'keep':182B 'last':9A,43A,98B 'later':69B 'leak':225B 'leav':201B 'llm':28A 'load':89B 'local':93B 'may':223B 'mem':3A,34A,48A,53A,62B 'mention':233B 'model':170B 'name':128B,222B 'noth':200B 'npx':59B 'open':79B 'opencod':19A,110B 'openrout':172B 'page':83B,88B 'parti':229B 'pass':24A 'path':130B 'pick':114B 'polici':199B 'privaci':198B 'project':127B,221B 'prompt':20A,119B,166B,213B 'provid':29A,177B,180B,192B 'read':91B 'releas':75B 'report':242B 'rout':173B 'run':58B 'say':162B,190B 'secret':215B 'sent':164B 'session':125B 'setup':49A,82B 'silent':6A 'silently':40A 'silently-uploads-the-last':39A 'soon':85B 'still':70B 'stop':135B,156B 'sync':210B 'tech':30A 'techniqu':57B 'text':120B 'the':42A 'third':228B 'tick':142B 'timestamp':132B 'tool':112B 'train':184B 'turn':207B 'unknown':27A 'unless':204B 'untick':152B 'upload':7A,50A,116B,137B,150B,231B 'uploads':41A 'v15':36A 'v15.2.0':5A,67B,237B 'v15.5.0':74B 'vendor':256B 'warn':56B 'whichev':111B 'whose':212B 'without':178B","nicknames":["claude-mem setup upload"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T13:56:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-claude-mem-installer-v15-2-0-silently-uploads-the-last-30-da","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-29T14:28:32+00:00","fetched_at":"2026-10-29T14:28:32+00:00","note":null}],"documents":[{"id":16893,"url":"https://news.ycombinator.com/item?id=50289137","title":"Installing Claude-mem uploads your last 30 days of prompts to cmem.ai, no opt-in","kind":"post","source":"hackernews","publisher":null,"text":"Installing Claude-mem uploads your last 30 days of prompts to cmem.ai, no opt-in\nhttps://github.com/thedotmack/claude-mem/issues/5176\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-29T13:56:38+00:00","relation":"describes","confidence":null,"note":null},{"id":17057,"url":"https://github.com/thedotmack/claude-mem/issues/5176","title":"Installing claude-mem uploads your last 30 days of prompts to cmem.ai, no opt-in (issue #5176)","kind":"issue","source":"analyst","publisher":null,"text":"Applies to anyone who runs npx claude-mem install interactively (installer v15.2.0 or later; latest v15.5.0) where the new setup has not been completed. Installer opens a browser setup page that reads local chat histories of the last 30 days regardless of tools selected: Claude Code ~/.claude/projects/*/*.jsonl (incl. subagents), Codex ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl, Gemini CLI ~/.gemini/tmp/*/chats/*, Antigravity CLI ~/.gemini/antigravity-cli/history.jsonl, OpenCode ~/.local/share/opencode/opencode.db. It uploads the full text of the prompts to cmem.ai with session IDs, project names, folder paths and timestamps as soon as the page loads; no way to stop it. The only checkbox ('Help make claude-mem smarter...') is ticked by default, disabled during upload, and cmem.ai confirmed unticking does not stop the upload. cmem.ai confirmed by email that prompts were sent to a DeepSeek model via OpenRouter routed to the cheapest provider, without blocking providers that keep or train on prompts; cmem.ai cannot say which provider received them. Deletion on request does not cover copies at OpenRouter/provider. Privacy policy says nothing leaves the device unless cloud sync is turned on. v15.5.0 (Oct 29) shipped with the upload unchanged. Source refs: src/services/work-view/hosted-intent.ts:161-171 (upload), src/services/prompt-import/index.ts:27 (30-day window). Mitigation in issue: block cmem.ai before running the installer.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}