Well yes, the problem is always communication and clear labeling on ANYTHING. Even food and beverage packaging got regulated to a degree that may be annoying to a layman. Doing something without context in the open WILL cause people to speculate. Imagine if you didn't see a sign about road work ahead and the traffic slows to a crawl. Would you think there is an accident? Or vice versa. So clear labeling about it being an experiment is a good idea from the start for any project IF AND ONLY IF the developer cares.

I for example didn't care if my FOSS library got used. I don't care if people criticize my language of choice or my code style. I license my stuff in MIT precisely because I couldn't care less about anything my software that I decided to be opened is doing. My open source model is I work for my own use case. I will not consider other use cases. It may contain vulnerability with certain configurations, so be it as long as I don't use those configurations. I will fix it if I feel like it. We need to normalize open source as an individual pet project again. If people depend on said pet project, that's on them, not the maintainer.

It's not worrying, it's becoming outrageously bad and hostile:

The client attestation system implies they're fighting API abuse through Claude Code. The NATIVE_CLIENT_ATTESTATION feature lets Bun's HTTP stack overwrite the cch=00000 placeholder with a computed hash, essentially a client authenticity check. This is a DRM-like mechanism to verify requests come from legitimate Claude Code installs, not from scripts or modified clients. It tells you that unauthorized API access through fake Claude Code clients is a real enough problem that they built cryptographic attestation into the binary.

from here: https://redlib.catsarch.com/r/ClaudeAI/comments/1s8ifm6/claude_code_source_code_has_been_leaked_via_a_map/odhuc7b/?context=3#odhuc7b (sorry, I'm too lazy searching for the actual original)