Every cloud AI coding assistant works the same way: your code leaves your machine, runs through someone else’s servers, and comes back as a suggestion. Whether that’s safe depends on three questions with checkable answers: does the vendor train on your code, how long do they keep it, and who can see it. The answers differ more between plans than between vendors. Business tiers default to private; individual tiers often don’t.

That gap is where teams get burned. Here’s what the four biggest tools actually do, what the Alibaba–Claude Code episode does and doesn’t prove, and a short list of settings worth changing today.

What actually happens to your code

When you accept a completion or run an agent, the assistant sends your active file, related context, and your prompt to the vendor’s servers. There’s no local-only mode on any of the mainstream cloud tools. The model runs on their infrastructure, not yours.

So the risk isn’t hypothetical “AI steals your code” headlines. It’s three concrete things:

• Training. Does your code become material for the vendor’s next model?
• Retention. How long do prompts and snippets sit on the vendor’s servers, and can you control it?
• Access. Who at the vendor (or in your org) can read what was sent?

Each vendor answers these differently, and the answer usually changes with the plan you’re on.

How the big four compare on data handling

Tool	Trains on your code?	The control that matters
GitHub Copilot	Individual plans: yes by default since April 2026 (opt-out available). Business/Enterprise: no; snippets not retained by default.	Privacy setting in Copilot settings; or a Business seat
Cursor	Not when Privacy Mode is on — available on every plan, including free.	Privacy Mode toggle (admins can enforce it team-wide)
Claude Code	Consumer plans (Pro/Max): only if you've enabled model improvement, your session is flagged for safety review, or you explicitly opt in. Commercial/API: covered by separate business terms.	Model improvement toggle in privacy settings
OpenAI Codex	API/business: no by default. But Codex on a personal ChatGPT (Plus/Pro) account: yes by default (opt-out under Data Controls).	Data Controls toggle on consumer accounts; admin-controlled retention on Enterprise

The details, with sources:

GitHub Copilot made the loudest change. Since an April 24, 2026 policy update, individual plans (Free, Pro, Pro+) use your interaction data — prompts, suggestions, surrounding code context — for model training by default, including inside private repos, unless you opt out in settings. Business and Enterprise seats don’t retain code snippets by default and don’t feed training. We covered the full picture in our Copilot privacy and security guide.

Cursor ties everything to one switch. Privacy Mode is available to anyone, free or paid; with it on, Cursor states it won’t train on your data and backs that with contractual requirements on its upstream model providers. New team members inherit the team’s setting, which is the right default for orgs. Anysphere (Cursor’s maker) holds a SOC 2 Type II attestation.

Claude Code splits by account type. On consumer plans, Anthropic uses your coding sessions for model improvement only in three cases: you’ve turned the setting on, the session gets flagged for safety review, or you’ve explicitly opted into a testing program. Work and API accounts run under separate commercial terms. If you’re running Claude Code on a personal Pro or Max plan against employer code, that settings page is worth two minutes of your time.

OpenAI (Codex and the API) is the most conservative by default for API and business use: business data isn’t used for training unless you opt in through feedback mechanisms, and on Enterprise plans workspace admins control retention, with deleted conversations removed within 30 days. The exception is the one that catches individual devs: run Codex through a personal ChatGPT Plus or Pro account and the consumer default is the opposite — your content is used to improve models unless you turn it off under Data Controls. We noted the same posture in our Codex CLI review.

What the Alibaba–Claude Code ban actually tells you

In early July 2026, Reuters reported that Alibaba banned employees from using Claude Code at work, steering them to its own Qoder platform instead. The trigger: developers had found that Claude Code inspected user environments (timezone, proxy-related information) and inserted markers into prompts sent to Anthropic’s servers, features that can help identify China-linked users. An Anthropic employee described it as an experiment launched in March to stop account abuse by unauthorized resellers and to protect against model distillation.

Context matters here. Anthropic had accused Alibaba of a “distillation” effort (training a weaker model on a stronger model’s outputs) in a letter to two U.S. senators, per the same Reuters report, and Anthropic’s terms already restrict access from China. So this wasn’t a neutral security audit finding a backdoor; it was one move in a running commercial and geopolitical fight.

But strip out the geopolitics and there’s a real lesson: the tool could see more of the user’s environment than users assumed, and nobody knew until someone went looking. That’s the honest takeaway for any engineering team. You don’t need to believe the “backdoor” framing to conclude that client-side telemetry deserves the same scrutiny you’d give any dependency. If a vendor’s CLI runs inside your network, what it collects is part of your attack surface — read the docs, and when the docs are silent, assume collection.

The risk your DLP can’t see

Traditional data-loss-prevention tooling watches for files leaving through email, uploads, and shared drives. AI assistants don’t look like that: the “exfiltration” is a stream of editor context inside a TLS session to an approved-looking developer tool. If your security model assumes file-level monitoring catches leaks, assistants sail under it.

That’s an argument for handling this at the account and policy layer, not the network layer: company-managed seats on business plans (where the no-training default is contractual), enforced privacy modes, and a written rule about which repos an assistant may touch. It’s also why “we blocked ChatGPT at the firewall” is theater — engineers route around blocks with personal accounts, which have exactly the weaker data defaults you were trying to avoid.

If the code truly can’t leave: local models

For codebases under strict IP or regulatory constraints, the only setup with nothing to audit is one where no code leaves the machine. Open-source assistants like Aider or Cline pointed at a locally hosted model give you real (if slower) AI help with zero vendor exposure — we cover the workable setups in our free AI coding assistants roundup. The tradeoff is genuine: local models trail the frontier models by a wide margin on hard tasks. Most teams don’t need this. The ones that do usually already know who they are.

A checklist that fits on a sticky note

For an individual dev using assistants at work:

1. Ask before pointing any AI tool at company code. An unapproved personal Copilot account on the company repo is how policies get written the hard way.
2. Use the work-provided seat, not your personal plan — the data defaults are meaningfully better.
3. Flip the privacy switch: Copilot’s training opt-out, Cursor’s Privacy Mode, Claude’s model-improvement setting.
4. Keep secrets out of context. .env files and credentials sitting in an open editor tab are visible to anything that reads editor context.

For a team rolling assistants out:

1. Buy business tiers; the no-training default is the product you’re paying for. (Current per-seat prices are in our pricing tracker.)
2. Enforce privacy settings centrally instead of trusting each dev to toggle them.
3. Write down which repos are in scope. “Everything except the crown jewels” beats no policy.
4. Treat assistant CLIs and extensions as dependencies: review what they collect, and re-review on major updates. That’s the Alibaba lesson in one line.

None of this makes the tools risky-by-default. It makes them what they’ve always been: a data flow to a third party that’s fine when configured on purpose and a liability when configured by accident. For the rest of the setup decisions — picking tools, plans, and workflows — see our other developer-tool guides.

• security
• privacy
• ai-coding-tools

Frequently asked questions

Do AI coding assistants train on your code?

It depends on the tool and the plan. GitHub Copilot's individual plans use your prompts and code context for training by default (you can opt out); Business and Enterprise don't. Cursor never trains on your data when Privacy Mode is on. Anthropic's consumer plans train on coding sessions only if you've enabled model improvement in settings, and OpenAI doesn't train on API or business data by default. The pattern: business tiers default to private, individual tiers make you check a setting.

Can AI coding tools leak proprietary code?

The realistic risk isn't the vendor republishing your code — it's your code leaving the building at all. Every cloud assistant sends your active files to the vendor's servers to generate suggestions, so the questions that matter are who can access that data in transit and at rest, how long it's retained, and whether it feeds training. Those answers live in each vendor's data-handling docs, and they differ by plan.

Why did Alibaba ban Claude Code?

Per Reuters, Alibaba banned employees from Claude Code in July 2026 after developers found the tool inspected user environments (timezone and proxy information) and inserted markers into prompts, features that can help identify China-linked users. Anthropic said it was an anti-abuse experiment aimed at unauthorized resellers. The ban sits inside a bigger dispute: Anthropic has accused Alibaba of distilling its models, and Anthropic's terms restrict access from China.

What's the safest way to use AI coding tools at work?

Get explicit approval before pointing any assistant at company code, use a business or enterprise plan rather than a personal account, turn on the tool's privacy mode or training opt-out, and keep secrets out of the editor context the assistant can see. If the code can't leave your network at all, a local model is the only honest answer.