News · 2026-11-07

Claude-Mem adds consent after setup uploaded prompt histories

Claude-Mem’s maintainers added an upload-consent gate after an earlier browser setup flow sent local AI prompt histories to a hosted service before presenting the choice. The project says the affected setup behavior ran in versions 15.2.0 through 15.8.2; version 15.8.3 changes the flow.

Key facts

• The project’s 15.8.3 release notes describe the affected version range and fix.
• The setup scanned 30 days of local histories in the affected interactive flow.
• Prompt text and metadata could be sent to the hosted service before consent.
• The release does not retroactively delete earlier uploads.

Claude-Mem is an add-on intended to give coding assistants persistent memory. The concern was in a particular first-time interactive browser setup, not evidence that every use of the project uploaded every conversation. The public issue and fix pull request identify histories from several coding tools and explain the sequence.

Imagine an assistant asking whether you want it to organize your files after it has already sent copies away for analysis. The ordering is the security issue: a choice presented after transfer cannot govern that transfer. The prior setup included prompt text, session identifiers and local project information, according to the project’s account. The fix holds detected material locally while presenting the user with a choice. The release offers “Keep everything local” as an option; selected tools can instead be uploaded after consent.

The released setup code and pull request describe the new gate. The fix author reported focused tests but did not run the complete suite or a real-browser user-interface check as part of that report. The project’s separate telemetry documentation concerns another data path, so an analytics setting should not be treated as proof about this setup upload.

The release notes explicitly warn that updating does not erase previous uploads. The issue describes a deletion request for one installation, but that is not evidence of a general deletion guarantee or deletion by downstream providers. The public material does not establish that every installation was affected or that any specific secret was exposed.

This is a concrete supply-chain lesson for AI assistants: an extension can access local histories that contain far more than the current prompt. Users and administrators need to understand what setup reads, when information leaves the machine, which service receives it, and what retention rules apply. The prompt-injection lesson covers a different but related trust boundary in agent workflows.

The project's fix describes several possible sources for the setup scan, including Claude Code, Codex, Gemini CLI, Antigravity and OpenCode histories. Those sources can contain more context than the user currently has on screen. A path may reveal project structure; a timestamp and session identifier can connect separate activities; prompt text may include instructions, business data or accidentally pasted credentials. The published record identifies categories of data in the flow, not the contents of every affected user's history.

There is a difference between detecting local files and uploading them. The new setup can scan locally to show which sources are available, then wait for a selection. Users can choose particular sources or keep everything local, according to the fix. That is a narrower and more meaningful choice than an undifferentiated analytics opt-out, because it concerns the prompt-history transfer itself.

The issue and release also illustrate the limits of a patch. Installing an updated version changes later behavior; it cannot by itself recover data already sent to a remote system. A reporter described a deletion request for their installation, but the reviewed record does not document all downstream copies or a universal retention policy. Affected users need an account-specific answer to know what was retained or deleted.

For organizations, the dependency inventory should include coding-assistant extensions and their setup screens as well as model providers. Administrators can review what local data an extension reads, where it sends it, and what switches control those transfers. The project says some noninteractive or already-completed setup paths bypassed this particular browser flow, so identifying whether a given installation used the affected path is more useful than assuming every user had the same experience.

Primary source, verified: read the paper →

Ground Truth. (2026, November 7). Claude-Mem adds consent after setup uploaded prompt histories. Ground Truth. https://groundtruth.day/news/claude-mem-setup-prompt-history-consent-fix.html

@misc{groundtruth:claude-mem-setup-prompt-history-consent-fix,
  title  = {Claude-Mem adds consent after setup uploaded prompt histories},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {nov},
  url    = {https://groundtruth.day/news/claude-mem-setup-prompt-history-consent-fix.html}
}

Topics: cybersecurity · ai-security · privacy · supply-chain