You’re already sending your prompts and context to their servers. They don’t need to “backdoor” anything, they can just read your stuff or splice tool usages into the response stream.

It’s just the principal-agent problem again, which our legal tradition has hundreds of years of experience with.