Closed models don't even need a back door - they will just MITM you and replace your code with malware.
Right, but I think everyone knows this. It's less obvious that a "fully locally run" model could pull a stunt like this.
(Your OS, or your device firmware, or even your CPU could be doing the same thing.)
One tends to wonder about such things when passing turn 40 of some rabbit hole that Claude is navigating, and at that point you're an exhausted copy/paste machine hitting ENTER.
Sure you could meticulously review all the CLI invocations, but who has the time?