Where does your code go when you use a cloud coding agent?
It depends on where the agent runs, and there are two separate questions. First, whose machine holds the checkout while the agent works. Second, whose account holds the credentials it uses. A cloud agent service clones your repository onto its infrastructure and holds tokens on your behalf. A locally run agent keeps both on your machine and sends only the text of the conversation to the model provider.
What is true regardless of what you pick
- Every approach sends something to a model provider, because the model is remote unless you are running a local one. What differs is whether that is only conversation text or also a full checkout.
- A local agent CLI sends the file contents it decides to read, along with your instructions, and keeps the repository and credentials on your machine.
- A hosted agent service clones the repository onto its own infrastructure, which usually means granting it repository access through an integration that can read more than the one repository.
- Model providers publish separate policies for consumer and business plans, and training on submitted content is commonly opt-out on one and off by default on the other. This is worth checking for your specific plan rather than assuming.
- Self-hosting the agent does not make the model local. It changes who holds the checkout and the keys, not where inference happens.
Your options, and where each one stops
| Approach | Good for | Breaks when |
|---|---|---|
| An agent CLI on your own machineThe agent runs locally; the repository and credentials never leave the machine. | Keeping code and keys in one place while still using a hosted model. The most common arrangement. | The machine sleeps or you want to reach the run from elsewhere, which is a persistence problem rather than a privacy one. |
| A container on hardware you ownThe same as above, with each agent isolated in a sandbox on your desktop, server or VPS. | Running unattended work and several agents at once while keeping everything on your own hardware. | You do not want to operate a machine. There is real, if small, ongoing maintenance. |
| A hosted cloud agent serviceThe vendor clones your repository and runs the agent on their infrastructure. | Speed and convenience with nothing to run, and reaching work from anywhere by default. | Policy or contract forbids code leaving your infrastructure, or the access grant is broader than you want to give. |
| A locally hosted modelInference runs on your own hardware, so no conversation content leaves at all. | The strictest requirements, and situations where no external processing is acceptable. | Capability. Local models remain behind the frontier hosted ones on long agentic coding tasks, and the hardware is not free. |
What to actually do
Ask the two questions separately. Whose machine holds the checkout, and whose account holds the credentials. Most of what people mean by privacy here is answered by those two rather than by any policy document.
If the answer has to be your own machine for both, a locally run agent is the baseline, and a container per agent on hardware you own is the version of that which also survives you closing the laptop.
That is what intentic does. The sandbox runs on your machine, the repository and the credentials stay inside it, and the platform stores your identity and the sandbox's address, with no ability to read your code or command your agents. The whole thing is MIT licensed, so the claim is checkable rather than promised.
Two questions, not one
Where the checkout lives and where the keys live are separate decisions, and conflating them is how people end up surprised. An agent running on your laptop with a production token has kept your code local and handed out significant access. A hosted agent with a read-only token has done the reverse.
Answer both explicitly for whatever you are evaluating, because a vendor page usually addresses one of them clearly and the other in passing.
What reaches the model either way
Any hosted model receives the parts of your code the agent chose to read, plus your instructions and the tool output from the session. That is true of local agents too, and it is the part people most often assume is avoided by running locally.
The difference a local setup makes is that nothing else is transferred: no full clone sitting on someone else's disk, no long-lived repository access granted to a third party, no credentials held in another account.
Checking a claim rather than believing it
The claims worth verifying are concrete: what the vendor stores, how long they keep it, whether submitted content is used for training on your specific plan, and what the access grant actually permits.
Open source helps here in a specific way. It does not prove what a hosted service does with your data, but it does let you read what the software on your own machine sends and to where, which is the part you can otherwise only take on faith.
Related questions
Does my code get uploaded when I use an AI coding agent?
With a locally run agent, the files it reads are sent to the model provider as conversation content, and the repository itself stays on your machine. With a hosted agent service, the repository is cloned onto the vendor's infrastructure as well. Both send something; only one sends a full copy.
Is my code used to train the model?
It depends on the provider and the plan. Business and enterprise tiers commonly exclude submitted content from training by default, while consumer tiers often allow it with an opt-out. The specific policy for your plan is the only reliable answer, and it is worth reading rather than assuming.
Does self-hosting the agent mean nothing leaves my network?
No, unless the model is also local. Self-hosting changes who holds the checkout and the credentials, which is significant, but the model is still remote and still receives the conversation. Only running a local model removes external processing entirely.
What is the most private way to use a coding agent?
A local model on your own hardware, with the agent running locally too, sends nothing anywhere. The realistic compromise most people take is a local or self-hosted agent with a hosted model on a plan that excludes training, which keeps the repository and the credentials on hardware you control.
Read next
Written against the state of the field in 2026-08. This area moves fast. Spot something out of date or wrong? Open an issue and it is fixed in the next build.