You are not too paranoid. There was a post just the other day about the Anthropic agent program sending people's emails to third parties. All the third parties had to do was require an email address to interact and the LLM would oblige because it had access to that information.