Four Cases on Developer Code: GitHub Published a Training Policy, Anthropic a Retention Policy, and Researchers Reported Grok Build and ZCode Uploads

Overview

Developers using AI coding tools learned what happens to their code and prompts in two different ways during 2026. GitHub announced on March 25 that from April 24 it would use interaction data from Copilot Free, Pro and Pro+ to train its models unless users opt out, and GitHub’s changelog says Anthropic’s Claude Fable models, offered in Copilot, require data retention by default to operate safety classifiers. In July and September, independent researchers reported that xAI’s Grok Build and Z.ai’s ZCode were packaging local repositories and uploading them to cloud storage.

This analysis compares those four cases. They are the Herald’s own selection, not a complete list of data terms or incidents. The reading that follows is also the Herald’s, and no cited source states it in this form: in the two announced cases the terms came with a plan scope and a date, while in the two discovered cases the settings that users could see are reported not to have covered the upload. Outside retests reported that both uploads stopped; the deletion of data already uploaded rests on the vendors’ statements or, for ZCode, on assessors the vendor engaged. The Herald’s contributor model is built by Anthropic, whose Fable retention terms are one of the four cases.

Background: two sets of published terms

GitHub Copilot and training. GitHub’s policy post says: “From April 24 onward, interaction data—specifically inputs, outputs, code snippets, and associated context—from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out.” The post says Copilot Business and Copilot Enterprise users “are not affected” and that the program does not use content from “issues, discussions, or private repositories at rest”. It adds that Copilot processes code from private repositories while in use, and that this interaction data “could be used for model training unless you opt out”. GitHub also says the data will not be shared with third-party AI model providers. The Register reported where to opt out, /settings/copilot/features, and that Business and Enterprise users are exempt “thanks to the terms of their contracts”. By the Herald’s count, the notice ran 30 days, from March 25 to April 24. The Herald reported the change at the time.

Anthropic’s Fable models and retention. GitHub’s September 1 changelog says that, unlike other Claude models in Copilot, Claude Fable 5.1 “requires data retention by default to operate Anthropic’s safety classifiers”, and that “Retained data is not used to train Anthropic’s models.” On Copilot Business and Enterprise an administrator must enable a Fable policy that is off by default, and “Leaving it off keeps Claude Fable 5.1 unavailable to your organization.” Eligible customers can use the models with zero data retention “through the end of the calendar year” under a time-bound exemption, and must contact their GitHub account team to learn whether they qualify. Anthropic’s post of the same date says it “introduced 30-day data retention starting with Fable 5”, states that this was “not motivated by a desire to train on enterprise data”, and describes a replacement, Enterprise Frontier Safeguards (EFS), that stores data “in cloud infrastructure controlled by the customer, not Anthropic” and rolls out in phases “starting later this fall”. TechCrunch reported that the system “will still monitor for misuse by agents or human users, but clients will control how the monitoring takes place.” GitHub’s November 9 changelog for Claude Fable 5.2 repeats the retention paragraph and the end-of-year exemption, now naming Fable 5.2, 5.1 and 5. The Herald reported the Fable 5.1 rollout on September 3.

Current situation: two discoveries

Grok Build, July. The Next Web reported that a researcher publishing as cereblab released a wire-level analysis on July 12, saying version 0.2.93 of Grok Build packaged developers’ entire tracked repositories, including Git history and committed secrets, and sent them to a Google Cloud Storage bucket. The Verge, relaying The Register’s report, dated the findings to “Monday”, which was July 13; the two outlets do not explain the difference and the Herald does not reconcile it. The Verge, again relaying The Register, wrote that the upload included “files it was told not to open and secrets deleted from history”, and SDxCentral that the feature was found to be active by default. The Next Web said xAI had marketed the tool with the claim that “nothing from your codebase transmitted to xAI servers during a session.”

The accounts of the controls differ. The Verge reported that Elon Musk said in a post on X that “privacy settings are always respected”, while asking users to allow retention because it is “helpful for debugging issues”. It also reported that SpaceXAI first pointed to a /privacy command, which Cereblab called “a per-session retention toggle, not the switch that fixed this”. The Next Web wrote that the privacy toggle “did nothing, according to multiple reports”. The Verge reported that Musk said previously uploaded data would be “completely and utterly deleted”, and that Cereblab’s retest saw SpaceXAI’s servers return a disable_codebase_upload: true flag and the upload “no longer fires”. SDxCentral, in a July 17 report, wrote that retention was switched off by default and that SpaceXAI had opened a bug bounty paying $100 to $20,000. As of its July 14 report, The Next Web wrote that “no independent audit has confirmed the deletion.”

ZCode, September. The Next Web reported that a developer writing as ferstar published an analysis on September 18 of a ZCode snapshot with 42,411 files, 86.6% of it Git directories, and a status log of 564 failed upload attempts. According to that account, two settings that looked as if they would stop the capture governed only what happened to the data downstream, and the privacy policy “said nothing about automatic workspace snapshots carrying full Git history.” InfoWorld described a default setting that sent repositories to Alibaba Cloud servers in China “without their consent”. Z.ai posted on Monday, September 21, that it had disabled the snapshot workflow in ZCode v3.14.0 and published the source. InfoWorld reported that Z.ai asked the China Academy of Information and Communications Technology and NSFOCUS to assess the result, and that Z.ai said the data “has never been used for model training”. The Next Web wrote that ferstar rechecked on September 21 and found the upload pipeline gone, but that the published repository carries two commits: “The development history is gone, and so is the code that did the uploading.”

Comparison: where the control sat and how the fix was checked

This is the Herald’s own tabulation of what the cited reports say; no outlet published it.

• Control. Copilot’s training use is an account setting on the individual plans, with contract terms for Business and Enterprise, per The Register. Fable retention is, on Business and Enterprise plans, an administrator policy that is off by default, with zero retention available to eligible enterprises, per GitHub. In both discovered cases the reports say the visible switch was not the control for the upload.
• Stated use of the data. GitHub says it trains on interaction data from Free, Pro and Pro+ users who have not opted out. GitHub’s changelog says Fable’s retained data is not used to train, and Anthropic says it has never trained on enterprise data without explicit permission. For ZCode, Z.ai says the data was never used for training. For Grok Build, The Verge quotes Musk giving debugging as a reason to retain data.
• Notice and checking. GitHub’s training change came with 30 days’ notice. GitHub’s changelog stated the Fable retention terms on the day the model became available, with an exemption for eligible enterprises that GitHub dates to year end. The two uploads reached developers through outside analyses. Outside retests reported that both uploads had stopped; the deletion of what was already uploaded rests on SpaceXAI’s statement and, for ZCode, on Z.ai’s statement and on assessors Z.ai asked.

Implications for developers

These points follow from the cited reports and are not predictions.

First, scope depends on the plan and product. The same developer is within the scope of the Copilot training program, with an opt-out, on a Free, Pro or Pro+ plan and outside it on Business or Enterprise, according to GitHub. Fable access in Copilot is available to Pro+, Max, Business and Enterprise users, and a retention requirement attaches to it. Second, exemptions carry dates. GitHub ties the zero-retention exemption to “the end of the calendar year”, and Anthropic says EFS arrives in phases from “later this fall”; none of the GitHub changelogs, Anthropic’s post or TechCrunch gives a specific day for EFS availability. GitHub’s changelog says that after the exemption ends, “continued use of the models will require EFS”. If read as December 31, 2026, the exemption runs 52 days after the November 9 changelog; that reading is the Herald’s.

Third, the label on a setting is not evidence of its scope. In both discovered cases the researchers’ accounts say the settings users could see did not stop the upload. InfoWorld quoted Cris Thomas, a security advocate at Semgrep, as saying that giving an AI access to proprietary source code “should require clear disclosure about what leaves the machine, where it goes, how long it’s retained and who can access it”. Fourth, stopping an upload and deleting what was uploaded are checked differently. Outside retests reported that both uploads had stopped. The Next Web wrote that ZCode’s published repository lacks its history and the uploading code, so that what it used to do cannot be inspected, and called the deletion claim one that “rests on the word of the party who deleted”.

What the sources do not settle

The date of the Grok Build analysis differs between The Next Web and The Verge. As of The Next Web’s September 22 report, “Nobody has said how long ZCode behaved this way before 18 September. Nobody has said how many workspaces it captured”, and Z.ai’s full assessment report had not appeared; the Herald did not check later coverage. No source cited here gives a day for EFS availability, so whether it will be ready when GitHub’s exemption ends is not established.