AI Coding Agent Privacy: Don't Trust the Toggle

In July 2026, The Hacker News reported that a researcher had found xAI’s coding CLI, Grok Build, uploading users’ entire Git repositories, full commit history included, to cloud storage. On a 12 GB repo, about 192 KB went to the model, while 5.1 GiB had already uploaded when the researcher stopped the test, and turning off “Improve the model” didn’t stop it. xAI’s own docs said prompt and file content were “assembled locally” and tools ran “locally.” Two months later, the South China Morning Post reported that a developer had found Zhipu’s ZCode uploading encrypted project snapshots, Git history included, to Alibaba’s cloud, while its privacy policy said the optimization program was “not enabled by default.” A coding agent can read your code, secrets and local files, and neither the privacy policy nor the settings page tells you what it sends out.

Key takeaways

• Between July 2025 and September 2026, five coding agents each had a data-egress incident: Trae, Claude Code, Grok Build, Qwen Code and ZCode. In none of the five did the privacy policy or docs of the time describe the data flow. Outside researchers and users found four by capturing traffic, inspecting local directories or taking binaries apart; a repository collaborator reported Qwen Code’s. The fixes either never reached a changelog or appeared as one line about “abnormal uploads.”
• Toggles cover less than their labels suggest. Trae’s telemetry switch only controls the VS Code framework’s telemetry. Grok Build’s “Improve the model” switch governs training, not repository uploads. ZCode’s “Repo Snapshot Indexing” switch stayed off while snapshots kept being created, because the server decided whether to collect.
• The documents themselves drift: Trae’s privacy mode page went from “your code stays local” to “your code gets uploaded” in a year. Egress that is documented but on by default needs the same review. Devin Desktop, Trae and Qoder upload code to build cloud indexes. GitHub Copilot’s personal plans have trained on interaction data by default since April 24, 2026. Gemini CLI on a free API key trains with human review. Cursor says requests “will still go through our backend” even with your own API key.
• Five coding agents come from China-based companies and serve overseas users. Trae’s international edition, Qoder and ZCode’s international edition contract through Singapore entities, but Trae’s policy lets ByteDance group entities access data remotely, and Kimi Code subscriptions fall under a Beijing entity’s policy with storage in China.
• A vendor review can’t stop at the contract. Capture egress traffic and test each switch during evaluation, and in the contract make undisclosed egress a breach, require notice of client changes and demand proof of deletion.

This is part 3 of our series on privacy across the AI supply chain. Part 1 mapped the 10 places a prompt gets stored, and part 2 reviewed 13 model vendors. This article covers only data egress from coding agents; security vulnerabilities such as prompt injection and sandbox escapes are out of scope. Part one lays out the facts, and part two covers what privacy and security teams should do with them. Incidents and terms reflect public information as of September 21, 2026; sources are in the appendix.

Part one: what the docs said, what the software did

Which of these uploads did the privacy policy disclose, or users expect?

None of them. The privacy policies users read and the toggles they saw described something else; what the software actually sent came to light only because outsiders captured traffic, dug through local directories or read repository records.

Trae (ByteDance, July 2025). The Register reported that after telemetry was disabled in settings, Trae still made around 500 calls and sent up to 26 MB in about seven minutes of normal use, including system information, usage patterns, unique machine identifiers, user ID and project information; the researcher’s published traffic capture shows the requests going to ByteDance’s overseas monitoring hosts. ByteDance then added a line to the toggle saying it “only controls telemetry collection via the VS Code IDE framework.” A user who turned off a switch labeled “telemetry” expected telemetry to stop; only part of it did, and the other channels had never been described. Trae’s privacy mode page later changed its story too, from codebase files “remain stored locally on your devices” to “temporarily uploads your codebase files to our servers to compute embeddings.”

Claude Code (Anthropic, June 2026). Ars Technica and TechTimes reported that when users pointed Claude Code at a third-party proxy or gateway through ANTHROPIC_BASE_URL, versions 2.1.91 through 2.1.196 rewrote the date line in every request’s system prompt. A Shanghai or Urumqi timezone switched the date separator to a slash, and the apostrophe in “Today’s” became one of four look-alike characters flagging whether the proxy hostname was on a 147-entry list of Chinese companies and resellers or contained AI-lab keywords such as deepseek and zhipu. Those signals traveled with the prompt through the proxy to Anthropic. The data-usage page said only that metrics “never include your code, prompts, or file paths,” and nothing mentioned that the prompt itself would be marked. An Anthropic engineer called it an anti-distillation “experiment” added in March; version 2.1.197 removed it on July 1 without a changelog note.

Grok Build (xAI, July 2026). The Hacker News reported that running Grok Build 0.2.93 in a Git repository packed every Git-tracked file and the full commit history into a git bundle and uploaded it to an xAI Google Cloud Storage bucket. On a 12 GB repo, about 192 KB went to the model while the storage endpoint received 5.10 GiB, including secrets deleted from earlier commits; turning off “Improve the model” made no difference. The Register reported that the researcher told the tool only to reply “OK” and not to open any files, and the whole repository was uploaded anyway; Elon Musk promised to delete the uploaded data, which the outlet said it could not independently verify. xAI’s enterprise docs said “prompt and file content assembled locally” and “tool execution happens locally.” In a follow-up, The Register reported that when xAI open-sourced Grok Build it acknowledged “data retention was enabled by default for non-ZDR users” in the early beta.

Qwen Code (Alibaba, September 2026). We found no media coverage; this account rests on a public issue in the repository. With usage statistics on, the default, any failed shell command run by the agent sent its unredacted error text to Alibaba Cloud’s monitoring service, and the first line of that text is the full command, so a git clone URL with a token or a curl with an Authorization header went along. The configuration docs say “We do not collect the arguments passed to the tools.” The fix shipped in version 0.23.4 on September 14.

ZCode (Zhipu, September 2026). The South China Morning Post reported that a developer found a 313 MB encrypted archive in ZCode’s local directory that had failed to upload to Alibaba’s cloud 564 times, while a 15 KB file had gone through; the large one was a snapshot of his commercial project, Git history included, decryptable only with a private key on Zhipu’s back end. According to the discoverer’s technical write-up, version 3.12.x packed and uploaded the whole workspace before every prompt while the user was logged in, with both “Optimize Experience” and “Repo Snapshot Indexing” switched off. ZCode’s privacy policy said the optimization program was “not enabled by default” and described collected content as material “submitted to us through conversation.” The Seoul Economic Daily reported that Zhipu blamed Repo Wiki page generation and said the data was discarded immediately; version 3.14.0 removed the feature, and its changelog says only “Fixed an issue with abnormal uploads in the repository wiki.”

What do the five incidents tell us?

Treat a privacy policy as the envelope of permissions a vendor grants itself, not as a description of its data flows.

• Toggles govern purposes, not data flows. Trae’s switch covered only framework telemetry, Grok Build’s governed training, and ZCode’s server decided whether to collect. The question in a review is “which requests stop when I turn this off.”
• Policies describe categories, not behavior. Phrases like “usage data” and “user content” can cover almost any upload after the fact, but no policy said “the whole repository is uploaded” or “a workspace snapshot goes out before every prompt,” and the docs change their story afterward.
• Fixes and deletions are hard to verify. Fixes rarely reached a changelog, and the deletion promises rest on the vendors’ word.

What documented egress might you have missed?

Beyond the incidents, some egress is written down by the vendor, just on by default and on a page you weren’t going to read.

• Cloud indexing sends the whole codebase. Devin Desktop (formerly Windsurf) says “the entire local codebase is then indexed (including files that are not open)” and doesn’t say where the embeddings live. Trae uploads codebase files in plaintext to compute embeddings and then deletes the plaintext, and the upload isn’t conditioned on privacy mode; its US privacy policy says it collects “embeddings and metadata associated with your codebase files.” Qoder indexes codebases under 10,000 files automatically, destroys uploaded files after generating vectors, and keeps the vectors in the cloud. Most of this is on product documentation pages rather than in privacy policies.
• Bringing your own API key doesn’t bypass the vendor. Cursor’s data-use page is blunt: “Even if you use your API key, your requests will still go through our backend!” Zero data retention “doesn’t apply when you use your own API keys,” and some models require retention with their provider; those are off by default and need admin approval.
• Personal-plan training defaults are shifting. GitHub announced on March 25 that from April 24, 2026, personal-plan users’ “inputs, outputs, code snippets, and associated context” would be used for training unless they opt out under “Privacy” in settings; the current docs list Free, Pro, Pro+ and Max, and Business and Enterprise aren’t used. The same update lets GitHub share this data with affiliates, “including Microsoft,” for AI development, and the opt-out covers affiliates too. On a free Gemini API key, Google uses submitted content to improve its products and “human reviewers may read” inputs and outputs, with no opt-out except for users in the EEA, Switzerland and the UK. Kiro counts paid users who sign in with GitHub, Google or AWS Builder ID as “individual subscribers” whose content may be used for training. Devin Desktop’s Teams tier trains by default, and “only an administrator” can opt out.
• Copies left on the machine. Claude Code stores session transcripts in plaintext under ~/.claude/projects/ for 30 days by default, and transcripts submitted through /feedback are kept for five years. ZCode’s open-source notice says model input and output logs are written locally by default and “may contain prompts and code.” These directories belong in endpoint data protection.
• Two documents from one vendor that disagree. JetBrains’ AI service terms rule out training on inputs and code, but a separate “detailed code-related data” program collects full model inputs and code snippets and keeps them for one year. It’s off by default for organizational licenses; for non-commercial licenses, the legal notice and the help docs give opposite defaults.

Do they train on your code, and where does the data live?

The two figures below split vendors by background: US and European vendors first, then China-based vendors serving overseas users. How to read them: in the training columns, No means the terms say no training, Opt-out means training is on until the user turns it off, Opt-in means off unless the user joins, Unclear means the terms are silent or contradict each other, and NA means the product doesn’t process the data itself. Locations use region codes, and anything involving China is red.

US vendors’ business plans almost all promise no training. The differences are in personal plans, which is what employees reach for first. Claude Code and Codex follow the user’s Anthropic or OpenAI consumer setting, chosen at signup or in settings; Claude Code consumer data is kept five years with training on and 30 days with it off. Cursor’s Privacy Mode is on by default for teams and enterprise, and the docs don’t say whether it starts on or off for individual plans. Amazon Q Developer’s free tier may be used for training; Pro isn’t. On Copilot business plans, IDE prompts aren’t retained, while CLI, web and mobile prompts are kept 28 days. Cline is an open-source extension where users bring their own model API key, so training and retention follow the chosen model provider (NA).

For this group, look at the contracting entity, not the product name. Tongyi Lingma was renamed Qoder CN in May 2026, runs entirely inside China and serves only the domestic market, so it isn’t in the figure. Alibaba’s overseas Qoder is run by a Singapore company with servers in the US, Singapore and Japan, but it doesn’t say where the Qwen and Kimi models it calls run inference. Trae serves three privacy policies by region: US users get the TikTok USDS joint venture; other overseas users get SPRING (SG), which stores data in Singapore and Malaysia but lets ByteDance group entities access it remotely, including for “training and improving our Corporate Group’s technologies,” without excluding entities in China; Trae Enterprise contracts through BytePlus and uses its DPA, while individual plans have none. Qwen Code is an open-source CLI whose training and retention follow the model plan you choose: Alibaba Cloud Model Studio’s Beijing region processes data in China, and the international edition processes it in Alibaba Cloud’s international regions. Kimi split in August 2026: the international service moved to kimi.ai under a Singapore entity, but the Kimi Code subscription page links to kimi.com’s privacy policy, signed by Beijing Moonshot, which says data is stored in China and that opting out of training means contacting customer service; only access through an API platform key falls under the Singapore entity’s terms. ZCode’s international edition is run by a Singapore entity, processes data in Singapore, and is the only one in this group where training requires opt-in. If your engineering tools keep code and data in China, expect trouble with the data location clauses in customer contracts and with security questionnaires. If a repository also holds Americans’ sensitive personal data, assess it separately under the DOJ data security rule covered in part 2.

Where do MCP tool calls take your data?

To the tool server, and the protocol doesn’t police that boundary. The MCP specification requires hosts to get explicit user consent before exposing user data to a server, but concedes that “MCP itself cannot enforce these security principles at the protocol level.” Every MCP server you connect is a new recipient of data. It may be your processor or an independent third party, depending on what it does with the data. Tool descriptions aren’t a basis for that judgment; the specification itself says clients “MUST consider tool annotations to be untrusted unless they come from trusted servers.”

Part two: what this means for vendor reviews and internal governance

Each issue from part one maps to evaluation, the contract and internal governance.

A few rows need more detail:

• How to capture traffic. On a test machine, use a proxy or firewall logs to record which domains the tool contacts and how much it sends. Model requests are usually kilobytes; a megabyte-scale upload needs an explanation. Capture again after turning off each switch to see which requests actually stop. Check local data directories too (~/.claude, ~/.codex, ~/.zcode and the like); ZCode’s upload came to light when someone noticed a local directory over 700 MB.
• Four more contract questions. Beyond part 2’s six (default retention, ZDR, training use, data location, human access, and contracting entity and DPA), ask whether personal and business plans have different training rules, whether code is uploaded for a cloud index, exactly which fields telemetry includes, and whether client changes are announced in advance.
• Breach notification timing. GDPR requires processors to notify controllers “without undue delay” after becoming aware of a personal data breach. Turn that into a specific number of hours so you can meet your own 72-hour deadline with regulators.
• Contracting entities change. Kimi and Tongyi Lingma both changed operating entities in 2026, so recheck at renewal.

What if your code has already been uploaded?

Start by checking whether it contains personal data. Repositories often hold test data, log samples, customer configurations and connection strings. If personal data is involved, a vendor uploading it beyond your instructions may be a personal data breach under GDPR, and as controller you need to assess the risk and decide whether to notify the supervisory authority within 72 hours. Many US state breach notification laws also cover account credentials. In order: identify the affected versions and time window, rotate every secret that could have left, ask the vendor in writing for deletion and proof of it, then work through your breach assessment and notification decision.

Frequently asked questions

Do coding agents upload my code to the vendor?

The part sent to the model always leaves your machine; that’s how the tools work. The question is whether anything else does. Devin Desktop, Trae and Qoder upload code for cloud indexing by default, and that’s documented. Grok Build uploaded entire Git repositories and ZCode uploaded workspace snapshots with .git history; neither was documented anywhere, and no setting stopped them. Capture egress traffic on a test machine and compare the size of model requests with everything else.

Is turning off telemetry enough?

Not necessarily. Trae kept reporting after users opted out, and ByteDance later clarified that the switch only covers VS Code framework telemetry. ZCode’s “Repo Snapshot Indexing” switch stayed off while snapshots were still uploaded. Qwen Code’s usage statistics can be turned off, but before version 0.23.4 they carried the full error text of failed commands while on. Verify each switch with traffic, and write into the contract which data flows each switch stops.

Does GitHub Copilot train on my code?

It depends on the plan. Since April 24, 2026, interaction data from Copilot Free, Pro, Pro+ and Max, including inputs, outputs and code snippets, may be used for training unless the user opts out in settings. Copilot Business and Enterprise data isn’t used for training. Company code belongs on Business or Enterprise.

Which coding agents process data in China?

Under terms as of September 2026, Kimi Code subscriptions fall under the kimi.com policy of a Beijing entity that stores data in China; Qwen Code processes data in China when used with Alibaba Cloud Model Studio’s Beijing region; Tongyi Lingma (Qoder CN) operates only in China. Trae’s international edition stores data in Singapore and Malaysia, with remote access for ByteDance group entities. Alibaba’s overseas Qoder, ZCode’s international edition and Kimi’s API platform are run by Singapore entities.

Which Claude Code users were affected by the hidden marker?

Only users who pointed Claude Code at a non-Anthropic API endpoint, such as a third-party proxy or gateway. It recorded whether the system timezone was Asia/Shanghai or Asia/Urumqi and whether the endpoint domain matched a list of Chinese company and reseller domains or a set of Chinese AI-lab keywords; it didn’t collect IP addresses or location. Versions 2.1.91 through 2.1.196 were affected, and version 2.1.197 removed it on July 1.

Appendix: sources

Incidents: Trae privacy mode docs, August 2025 snapshot, April 2026 snapshot, Unit 221B analysis, telemetry research repository, The Register; Claude Code data usage, marker analysis, GitHub issue #67120, changelog, TechTimes, AI Weekly, Global Times, Ars Technica, CNBC; Grok Build enterprise docs, The Register, July 14, pre-incident snapshot, researcher’s report, API security FAQ, researcher’s reproduction repository, The Hacker News, The Register; Qwen Code configuration docs, issue #11198, fix PR #11649, issue #12002, PR #12361; ZCode pre-incident privacy policy snapshot, researcher’s write-up, second developer’s analysis, September 18 apology (IT Home), September 21 statement (IT Home), changelog, Chengming legal letter (Sina), TechNode, open-source repository NOTICE, South China Morning Post, Seoul Economic Daily.

Terms and docs: GitHub Copilot training policy update, GitHub Copilot policy management, Copilot plans and retention; Gemini API terms; Cognition platform terms, Devin Desktop codebase indexing; Kiro data protection; Amazon Q Developer service improvement; Cursor data use, security; JetBrains AI service terms, product data collection; Trae privacy policy, enterprise, BytePlus DPA; Qoder privacy policy, codebase indexing; Qwen Code terms and privacy notice, qwen.ai privacy policy; Kimi API platform privacy policy, kimi.com privacy policy; Z.ai terms of use, ZCode international privacy policy, China privacy policy.

Protocol and law: MCP specification 2025-11-25, MCP tools; GDPR.

This article is an engineering and compliance reading of public incidents and vendor terms, not legal advice. Earlier in the series: AI Data Compliance Map and LLM API Privacy Due Diligence.