Does My Source Code Leave My Computer When I Use an AI Coding Assistant?

Does my source code leave my computer when I use an AI coding assistant?

Yes, when the assistant uses a hosted model, the relevant context must leave your machine for inference. The editor may be local while the model is remote. Those are separate facts, and confusing them can leave a repository exposed under settings you did not intend.

GitHub explains that Copilot processes code context when you actively use it and that code must be sent from your local environment for hosted assistance. OpenAI’s Codex security documentation likewise says Codex sends prompts and files to OpenAI for inference and returns outputs to the workstation. In other words, a command-line or desktop interface does not by itself prove that processing is local.

There is another distinction worth keeping: sending context for a response is not the same as retaining it indefinitely or training a model on it. Ask three separate questions: what leaves the machine, how long it is kept, and whether it can be used to improve models. A tool can transmit code for inference while its applicable privacy terms prohibit training on that data.

Some features create additional data paths. Cursor says its AI features send prompts and code context to model providers. Its optional Cloud Agents require repository access over time and temporarily store encrypted repository copies while an agent runs. Cursor describes TLS 1.2 or higher in transit and AES-256 at rest, but encryption does not change the underlying question of what the feature receives and stores.

Can AI coding tools use private code to train their models?

Sometimes; the answer depends on the provider, plan, and the specific training control. Never infer the rule from a product name or from the fact that a repository is private.

GitHub’s policy documentation says that, starting April 24, 2026, inputs, outputs, code snippets, and associated context from Copilot Free, Pro, Pro+, and Max may be used to train and improve models unless the user disables the setting in Copilot settings. GitHub states that Copilot Business and Enterprise customer data is not used for model training and is protected under its Data Protection Agreement. Individual subscribers should locate the training control and confirm its current state; organizations should verify the applicable plan and agreement.

OpenAI draws a similar line between individual and organizational offerings, with important settings to check. Its help documentation says content from individual Free, Plus, and Pro services may be used to train models, and users can turn off “Improve the model for everyone” in Data controls. That setting also applies to new Codex tasks, but Codex has a separate “Include environments” training setting. Changing the ChatGPT or Privacy Portal preference does not change that separate setting.

OpenAI says inputs and outputs from ChatGPT Business, Enterprise, Edu, and its API are not used to improve models by default, unless an organization explicitly opts in through a separate agreement or data-sharing control. For individual plans, submitting thumbs-up or thumbs-down feedback may allow the associated conversation to be used for improvement even after opting out. That is a practical reminder: review feedback behavior as well as the main training switch.

Cursor says Privacy Mode prevents code from being used for training by Cursor or model providers. Enterprise teams have Privacy Mode on by default, and administrators can enforce it. However, Cursor notes that most models use zero-data-retention agreements while some may require provider retention and administrator approval. Model choice can therefore affect the data path, even inside one product.

How do I check an AI coding tool’s data retention and privacy settings?

Check the plan, the specific model, and every enabled feature before adoption; then turn the policy into enforced configuration and test it. A settings screen is a starting point, not proof that sensitive files are blocked.

1. Map what is sent. Ask whether prompts, open files, repository context, terminal output, and environment details go to a hosted provider. List optional features such as cloud agents separately. For each, identify the provider and whether it needs continuing repository access.
2. Verify training controls by plan. Find the exact setting for model improvement, including any separate controls for coding environments or feedback. Record the plan and account type the rule applies to. Do not treat “paid” as a synonym for “not used for training.”
3. Read retention terms. Check provider retention, zero-data-retention availability, exceptions by model, and whether administrator approval is required. For enterprise use, review the agreement and data-protection terms, not just a product FAQ. OpenAI’s HIPAA configuration guide also makes clear that organizations remain responsible for workstation configuration, repository access, local retention, and enabled MCP servers, plugins, connectors, and third-party services.
4. Block sensitive inputs. OpenAI’s Codex Security Cookbook recommends filesystem profiles that deny reads of paths such as .env*, *.pem, *.p12, id_*, .aws/**, and .kube/**. It also recommends excluding environment-variable patterns such as *_TOKEN, *_SECRET, *_PASSWORD, AWS_*, and GITHUB_*. Add exact deny paths for credential directories, signing keys, production configuration, and unrelated repositories.
5. Run two tests. Confirm that the assistant can complete an approved coding task. Then deliberately try to access a blocked file or credential path and confirm that access is denied. The cookbook warns that user-configurable defaults are not the same as enforced requirements.

Keep one compact review record: plan, model, training setting, retention rule, excluded paths, excluded variables, cloud features, and test result. This gives engineering and security teams a concrete change to review when a provider, model, or policy changes.

Code indexing deserves its own question. A tool may index or retrieve repository context to answer requests, but indexing does not by itself tell you whether code is stored, how long it persists, or whether it is used for training. Ask the vendor to describe each separately and identify which controls apply. Before rollout, assign one owner to verify those answers and rerun the blocked-workflow test.