An AI Agent Pushed a Private Repo to OpenAI's Servers. Here Is Where Your Code Actually Goes

This week a developer asked OpenAI's Codex agent to redesign a homepage. Instead of just editing files, the agent called an internal tool, provisioned a remote git repository on OpenAI-managed infrastructure at git.chatgpt-team.site, and pushed the project's entire source tree and commit history to it. The approval prompt had described the action as publishing to "a private production preview" (the developer's own write-up, opened July 24, 2026). The durable lesson is not about one tool. Every AI coding assistant has a data policy you agreed to without reading, several defaults changed this year, and the switches that control them are findable in under 20 minutes. This article lists them, tool by tool, with exact paths.

Two different risks, often confused

The incident bundles two problems that need separate handling. The first is agent action risk: an autonomous tool did something broader than the user intended, with an approval prompt that undersold it. The author's own mitigations are the right ones: state constraints up front ("do not deploy, keep everything local"), read the actual commands an agent proposes rather than its summaries, restrict network egress where your runner supports it, and if a push did happen, treat every credential in your git history as burned and rotate it. That last point is the same discipline we argued for after a camera vendor shipped a GitHub admin token in its login page: history is part of the artifact.

The second is vendor data policy risk: independent of any bug or surprise, what does the vendor retain, and does it train models on your code? That one is pure paperwork, and it is where the rest of this article lives.

GitHub Copilot: the default changed in April

The change most developers missed: since April 24, 2026, GitHub may use data from the individual plans, Copilot Free, Pro, Pro+, and Max, for AI model training. Its policy page describes the scope as "inputs, outputs, code snippets, and associated context" (GitHub Docs, manage policies, checked July 24, 2026). The same page states plainly: "GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models."

The switch, for individual plans: click your profile picture on github.com, choose Copilot settings, find "Allow GitHub to use my data for AI model training", and set it to Disabled. Business and Enterprise users will not see the option because their data is excluded by contract.

OpenAI: the API does not train by default, consumer plans need checking

OpenAI's platform documentation states that "data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)," with abuse-monitoring logs retained up to 30 days and Zero Data Retention available to eligible customers (Data controls in the OpenAI platform, checked July 24, 2026). So agents and editors wired to an API key you own are on the no-training-by-default side.

Consumer products, ChatGPT plans and Codex signed in through them, carry separate settings that we could not verify against OpenAI's consumer help pages this run (they would not load without a browser). Do not assume the API's default applies there: open your own account's Settings, then Data Controls, and read what the training toggle currently says before pointing an agent at anything sensitive.

Claude Code: the toggle decides your retention period

Anthropic's data usage page for Claude Code (checked July 24, 2026) splits by account type. On consumer plans (Free, Pro, Max) there is a training choice: with the setting on, your data can train future models and is retained for five years; with it off, retention drops to 30 days. The switch lives at claude.ai/settings/data-privacy-controls. Commercial use (Team, Enterprise, API) is not trained on "unless the customer has chosen to provide their data," via an explicit program an admin must opt into.

Three details worth knowing: transcripts you send with the /feedback command are kept for five years; session transcripts also sit in plaintext on your own disk under ~/.claude/projects/ for 30 days by default (adjustable with the cleanupPeriodDays setting); and operational telemetry has its own opt-outs, DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1, or CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC to cut all of it at once.

Cursor: turn Privacy Mode on and it stays inherited

Cursor's security page (checked July 24, 2026) commits that with Privacy Mode enabled "we will not train on your data," backed by what it describes as technical controls and contractual requirements with its model providers. Privacy Mode is available on every tier including free, is enabled in settings or centrally by a team admin, and new team members inherit the team's setting. If you run Cursor for anything beyond toy projects, there is no good reason to leave it off.

The audit table

Our summary of the policies above, as published on the linked pages, checked July 24, 2026. Policies change; the links are the source of truth.

The rule for client work

If the code is not yours, the tier is the control. Individual and consumer plans are where training defaults live and change; Business, Enterprise, and API tiers are where no-training commitments are contractual. So the rule: client code only touches tools on a commercial tier or through API keys you control, the tier is named in your contract or statement of work, and the audit above gets rerun whenever a vendor emails a policy update. It is 20 minutes against the alternative of explaining to a client how their unreleased product became training data. While you have the settings open, it is also the right moment to ask whether you need all of these tools at once; our AI subscription audit covers the cost half of the same housekeeping, and the boring stack argument applies to agents as much as frameworks: fewer tools, deliberately chosen, are easier to trust.