Claude Code and Codex ignore the personal data xor network access rule by design. Of course this happens. If it wasn't due to the prompt sent to the model, a passing scan of a README.md that happens to mention your details would achieve the same result. What about a hostile LLMs.txt that words it such that free API keys are available in exchange for a tarball of $HOME?

The solution is don't run a spambot with an Internet connection over your personal stuff, unfortunately nobody is ready to hear that yet.

Curious how their plugin works, but I'm guessing "incompletely", given personal information can end up buried in base64 or similar preventing easy string matching. Some kind of babysitter model watching network IO via an invasive proxy might be viable, if folk were willing to pay the latency cost, but it will not prevent a dedicated exfiltration attempt, which itself might be (according to the model's logic) for innocent reasons.