The things you allow the LLM to read will obviously be sent as part of a prompt. You can control that though. Reads are tool calls and you can configure permissions for that or be asked every time the agent wants to read something.

This is straight up just uploading your whole working directory. Not as a LLM prompt, but to a Google Storage.

I think in this case the tool was sending the contents of the entire folder it was started in, no matter what files the LLM actually read.

The better models generally try to at least make a meandering attempt to not upload secrets (like .env tends to contain)

More or less, but most harnesses will rely on tools such as grep to only read portions of files. For even a small sized repo, only a small portion would be tokenized and uploaded

5.1GB?