It's Claude code talking to another Claude code. They're both already leaking your data to Anthropic in the first place.
Pretty much nothing with minimum viable guardrails (restricted shell into Container into MicroVM into VM + Firewall) which any dev knows how to setup, the fact that most don't is mostly about lazyness/recklessness.