Does Your Coding Agent Train on Your Code? 21 Tools, Checked

Every coding-agent vendor puts a SOC 2 badge on its homepage. Almost none of them put the answer to the question a developer actually has anywhere near that badge: does my code train your model, right now, on the plan I’m already paying for? SOC 2 certifies that a company follows its own stated security controls. It says nothing about what that policy actually permits by default.

So we read the primary source for all 21 coding agents in our index: each vendor’s own data-usage, privacy or security documentation, not its marketing page. For every tool we asked the same two questions. Does the free or entry individual plan train on your code by default, and does the team or enterprise plan? Those two answers are frequently different, and the entry-tier answer is the one most developers are actually living under.

The headline: most popular agents train on your code unless you turn it off

8 of 21 tools (38%) train on your code by default on their individual or free tier, including three of the most widely used agents in this index. GitHub Copilot flipped its default on April 24, 2026: interaction data from Free, Pro and Pro+ accounts now trains Copilot’s models unless you opt out in account settings, a reversal from the prior opt-in model. Claude Code went through the same reversal eight months earlier. An August 2025 terms update moved Free, Pro and Max accounts from no-training-by-default to training-by-default, and Anthropic’s own documentation confirms coding sessions on those tiers “can be used to improve Claude” unless the setting is changed at claude.ai. Cursor never flipped a public default; it shipped one from the start. Privacy Mode (zero retention, no training) is on and locked for Business and Enterprise seats, but an individual on the Free or Pro plan has to find Settings → General and turn it on manually, per Cursor’s own data-use page.

The other four in this group (OpenAI Codex CLI, Google’s Antigravity CLI, and Cognition’s two products, Devin and Windsurf) follow the same shape: a protected default for the tier that pays for admin controls, and an opt-out, not opt-in, default underneath it. OpenAI’s business-data page states plainly that ChatGPT Business, Enterprise and API traffic is never used for training, while individual ChatGPT accounts running Codex CLI train unless the user opts out in settings. Antigravity CLI collects “Interactions” data (prompts and the actions the agent took) by default for anyone signed in with a personal Google account, per its own security documentation. Log in through Google Cloud or Gemini Enterprise instead, and that data inherits GCP’s standard no-training terms. Cognition’s Devin security docs and privacy policy state that data “may be used for model training” by default on paid individual and Teams plans, with an opt-out available in Data Controls at any time. The same terms carry over to Windsurf, which Cognition acquired: Teams and Enterprise seats on either product get Zero Data Retention automatically, but an individual paying for Devin or Windsurf Pro is opted in until they act.

The eighth is Meta’s Muse Code, and it doesn’t fit the settings-toggle shape at all — the tradeoff is priced, not flipped. Muse Code bills per token through two model IDs: muse-spark-1.2-contributor, which trains on your prompts and completions and costs roughly 8-12x less, and muse-spark-1.2 (Standard), which carries a stated no-training commitment at full price. Meta’s own developer blog describes switching away from the contributor model to reach Standard pricing, not the other way around, and independent reporting is explicit that the contributor tier is what a fresh install lands on: “by default, the product routes developers’ source code and prompts into Meta’s training pipeline,” per DevX, with organizations needing to “consciously opt out” by moving to Standard. It’s the only tool in this census where the training tradeoff has an explicit price tag instead of a checkbox.

The 6 that are private by default, no toggle required

Six tools don’t put the burden on the user at all:

• Factory: “Factory never trains on your code,” stated flatly in its own CLI security docs, true across every tier, backed by SOC 2 Type II and GDPR compliance with a public trust center.
• Warp: Zero Data Retention with every contracted LLM provider by default. Warp states it does not persistently store or train on customer code, per its security overview and 2026 SOC 2 Type 2 report.
• Zed: no prompt or code-context retention by default. Training-data collection for its Edit Prediction model is strictly opt-in, and Zed states it uses no third-party service that trains on your data, per its AI privacy docs.
• Replit Agent: Customer Content is private and, per Replit’s commercial agreement, not used to train models “except as expressly permitted.” The real carve-out: route through a free-tier model provider or publish an app publicly, and that content can still be used to improve the underlying model. The protection is for private, paid-tier usage specifically.
• CodeRabbit: states plainly that “neither CodeRabbit nor OpenAI nor Anthropic uses personal information collected as part of the code review to train… models,” backed by SOC 2 Type II audits and a public trust center. One real carve-out worth knowing: CodeRabbit does use open-source project reviews to train its own internal review systems, a different, narrower use than training a foundation model but still a use, per its privacy policy.
• Junie: JetBrains’ AI Service Terms state it will not use inputs, data, outputs or suggestions to train any language model “unless You expressly agree to it,” and its data collection and usage policy confirms detailed code-related data isn’t collected from commercial users without explicit, informed consent. The commitment doesn’t change between the free tier and a paid Pro or Ultimate plan; JetBrains lists a Junie-scoped SOC 2 Type II attestation, alongside company-wide GDPR compliance, in its Trust Center.

5 tools where the question doesn’t apply the same way

Cline, Aider, OpenCode, Juggler and Zot are all open-source, bring-your-own-key harnesses with no vendor-run inference service sitting between you and the model. Point any of them at Anthropic, OpenAI, or a local Ollama model, and your code goes straight to whichever provider you configured. None of these five tools is itself in the data path, so “does the tool train on your code” redirects to “what’s your model provider’s policy.” Cline’s own terms note that non-code telemetry is on by default but can be disabled in extension settings; the code itself never touches Cline’s servers. The practical upshot: choosing one of these five doesn’t remove the training-defaults question, it just moves it one layer down to whichever model you bring.

2 undisclosed

Bolt.new: an independent security audit found its privacy policy discloses AI feature usage and data-deletion timelines but stays silent on the specific mechanism and default for AI-training data use. The policy states users “may have the ability to limit or opt out” depending on plan, without stating what happens if they don’t. OpenHands: the fully self-hosted and Enterprise private-VPC deployment keeps code in your own environment by construction, per its enterprise page. We found no published default-training statement for the managed OpenHands Cloud tier specifically. Both are flagged here rather than guessed at; if either vendor publishes a clearer statement, this table gets corrected, not re-guessed.

The full table

Tool	Individual / free default	Team / enterprise default	Certifications found
GitHub Copilot	Trains by default (since Apr 24, 2026); opt-out in account settings	Never trains	none found
Claude Code	Trains by default (since Aug 2025); opt-out in privacy settings	Never trains (Claude for Work, API, gov’t)	SOC 2 Type II, ISO 27001, ISO 42001
Cursor	Trains by default; Privacy Mode must be enabled manually	Privacy Mode on by default	SOC 2 Type II
OpenAI Codex CLI	Trains by default on individual ChatGPT plans; opt-out available	Never trains (Business, Enterprise, API)	none found
Antigravity CLI	Collects “Interactions” data by default (personal Google login)	Never trains (Google Cloud / Gemini Enterprise login)	none found
Devin	Trains by default on paid individual/Teams; opt-out anytime	Never trains without written consent (Enterprise)	none found
Windsurf	Trains by default on individual; opt-out anytime	Zero Data Retention by default (Teams, Enterprise)	SOC 2 Type II, HIPAA BAA, FedRAMP High
Muse Code	Trains by default (Contributor tier, the default on-ramp)	Same two-tier choice for any account; switch to Standard to opt out, full price	none found
Factory	Never trains, any tier	Never trains, any tier	SOC 2 Type II, GDPR
Warp	Never trains, any tier	Never trains, any tier	SOC 2 Type 2
Zed	Never trains, any tier (opt-in only)	Never trains, any tier	none found
Replit Agent	Never trains private content; free-tier model providers and public Repls are the carve-out	Never trains	SOC 2 Type II
CodeRabbit	Never trains on reviewed code; OSS reviews train CodeRabbit’s own systems	Same as individual	SOC 2 Type II
Junie	Never trains, any tier, unless the user expressly agrees	Same as individual	SOC 2 Type II (Junie-scoped), GDPR
Cline	N/A: BYOK, code never reaches Cline’s servers	N/A	none found
Aider	N/A: BYOK, code never reaches a vendor server	N/A	none found
OpenCode	N/A: BYOK, code never reaches a vendor server	N/A	none found
Juggler	N/A: BYOK, code never reaches a vendor server	N/A	none found
Zot	N/A: BYOK, code never reaches a vendor server	N/A	none found
Bolt.new	Undisclosed: policy is silent on the training-data default mechanism	Undisclosed	none found
OpenHands	Self-hosted/private-VPC keeps code in your own environment; managed Cloud default not published	Same	none found

What to actually check before you wire one in

A SOC 2 badge answers “does this vendor have controls and follow them.” It does not answer “is my code training a model right now.” Those are different questions, and the second one is the one that matters when you’re deciding whether to point a coding agent at a proprietary repository. Two practical takeaways from this census. First, the plan tier you’re actually paying for might not be the one the vendor’s security page is describing: Cursor, Devin and Windsurf all reserve their strongest default for a tier above the one most individual developers buy. Second, “open source” and “BYOK” aren’t automatically a training-privacy answer either; they just relocate the question to whichever model provider you point the tool at.

This is a snapshot as of August 2026. Vendor data policies change. GitHub’s and Anthropic’s defaults both flipped within the past 12 months, so treat this table as a starting point for your own vendor’s current terms, not a permanent verdict.

Methodology: for each of the 21 coding agents in our index, we read the vendor’s own privacy policy, data-usage documentation, or security/trust center page directly, not third-party summaries, and recorded the stated default for the lowest paid or free individual tier and for the team/enterprise tier separately. Where a vendor’s public documentation didn’t state a clear default, we marked it undisclosed rather than assume either answer.