[upon_drumhead]

The API key is unvalidated and so any entry that isn't exactly a blank string is treated like a valid key and data is sent out. There's a risk there that a future version may handle the blank key incorrectly or differently and start transmitting away. For some people, the possibility of a string handling bug or a filesystem corruption or what not is enough of a risk to avoid the software.

[lurkersince2013]

If you're so paranoid about this possibility then just block it at the network level - heck, even whitelist IP ranges that you want iTerm2 to be able to connect out to and default deny the rest.

Let's not blame iTerm2, which is a highly useful, amazing piece of software that many of us have relied on on every day for years and have never paid anything to use.

If you really are so worried about the AI feature being part of iTerm2 then go fork it and strip the AI functionality yourself: https://github.com/gnachman/iTerm2