When your AI coding assistant uploads your whole repo

You gave an AI tool access to your editor. Did you also give it your whole repository — history, config, and the secrets someone once committed by accident — copied to a vendor's cloud? For a lot of teams, the honest answer this month turned out to be yes.

If you work somewhere regulated, that is the moment the conversation about a self-hosted AI coding assistant — or at least a local one that never phones home — stops being theoretical. This is about the one architectural question that decides whether your code leaves your network, why the answer keeps going the wrong way, and what "self-hosted" actually has to mean to be worth anything.

In mid-July 2026, security outlets reported that xAI's Grok Build coding tool was sending far more than the code you handed it. As The Hacker News put it, "Grok Build uploaded entire Git repositories, full commit history and all, to xAI storage, not just the files the agent read." (Reported 13–14 July 2026.)

To xAI's credit, they responded: a new setting stops the upload, the privacy command was widened to disable retention and delete already-synced data, and Elon Musk said the stored data would be purged. So this is not a hit piece on one vendor — they found it, they fixed it. It is a worked example of a pattern.

The Grok story is vivid, but it is not alone:

• CamoLeak — Legit Security disclosed a critical flaw (CVSS 9.6) in GitHub Copilot Chat on 8 October 2025, fixed by GitHub, that could have allowed silent exfiltration of secrets and source code from private repositories.
• EchoLeak — a zero-click flaw (CVE-2025-32711) in Microsoft 365 Copilot, disclosed in 2025 and fixed by Microsoft, that could have allowed data to be exfiltrated with no user action (write-up: Aim Security).
• "Does Copilot train on your code?" — a fair question, and the honest answer is it depends on your tier. GitHub's own documentation says Copilot Business and Enterprise do not train on your private code or prompts. The change that caused the noise applies to the free and consumer tiers, where training is on by default unless you opt out — and even seasoned developers called the communication confusing.

Different tools, different mechanisms, same shape: your code, or the ability to reach it, ended up somewhere you did not put it.

Because the default architecture makes it almost inevitable. A cloud AI assistant has to send something to a model that runs on the vendor's servers — and once your code is crossing that boundary, the difference between "a snippet for context" and "the whole repo for convenience" is a product decision made on the other side of a wall you can't see. You are trusting a setting, a privacy policy, and a roadmap you don't control. When any of the three moves, your code moves with it.

For a hobby project, fine. For a codebase under a regulator, a customer contract, or a security review, "trust the vendor's toggle" is not a control you can put in an audit.

Strip away the branding and every AI tool answers one question: does my data leave my environment?

If the model runs on the vendor's cloud, your data leaves. Everything else is terms and conditions. If the model runs on infrastructure you control, it doesn't. That's the whole difference.

A local AI coding assistant (a model on your own laptop or workstation) answers "no" for one developer. A self-hosted setup answers "no" for a whole team, on your own servers, behind your own network boundary — which is what a regulated organization actually needs.

"Self-hosted" gets stretched until it means nothing, so here is the bar worth holding a tool to:

• Runs on your infrastructure, on the model you choose. Your servers, your LLM endpoint — cloud-hosted or fully on-prem and air-gapped.
• One outbound boundary, and you can see it. Exactly one connection leaves: the call to the model endpoint you configured. Nothing else phones home — no telemetry pipe, no "sync for convenience," no second bucket.
• You can read the code. If it's source-available, your engineers can verify what it does and where data goes instead of trusting a marketing page. (Source-available, not "open source" — you can read and run it under a clear licence; the point is verifiability.)
• An audit trail you keep. Every action attributable to a named principal, logged on your side, exportable to your own systems — because "we didn't send your data anywhere" is a claim your auditors get to check, not take on faith.