Oh My OpenAgent has disclosed a privacy bug in OmO Native: switching telemetry off during a running session did not stop that session from sending usage events. The developer says the affected events contained no prompts or file contents. The corrected release checks consent when sending, while deletion of previously transmitted data requires a request tied to the installation.
Oh My OpenAgent, a project for coding-agent software, disclosed that OmO Native kept sending usage events after users disabled telemetry during a running session. The defect first affected version 5.0.0-beta.6; it remained present in version 5.1.34. Users who had opted out before launch were unaffected, as were those using environment variables. The disclosure identifies a failure to apply a changed consent choice during that session.[1]
Version 5.1.35 checks consent when events are sent. A check is reused for no more than 5 seconds; queued events are dropped after the opt-out is read. At startup, an existing refusal prevents creation of the session hash and its salt, along with the notice marker and summary file. The developer says the affected events carried a session hash but neither the text of prompts and responses nor the paths and contents of files.[1]
The release document says events sent after the ineffective opt-out cannot be distinguished from consented events. Deletion therefore covers an installation's records. Users are directed to request erasure through the repository's private vulnerability-reporting form with their installation identifier. Old machine-hash events are included only when the stored mapping connects that hash to a single installation. A shared history needs separate proof of ownership.[1]
