When an AI agent gets your repository, your source code, business logic, and customer data leave your machine and reach a model provider. This page traces that path, documents the incidents that have already happened on it (every incident carries a source link), and states what Aexol can and cannot do about it.
In the standard cloud setup, prompts travel from your machine to the provider's API. From there, the content passes through the provider's logging and analytics systems, reaches its sub-processors, and may be used for training and model improvement under the provider's terms.
When an agent receives your repository, each request transfers its contents to the provider's API — source code, business logic, architecture, customer data, and keys and secrets. The provider processes the content on your behalf; what happens to it afterwards is governed by its terms, not yours.
You generally cannot see those logs, audit the sub-processors, or verify what was stored.
Documented incidents from 2026, summarized from the linked reporting. Every card carries its source links.
OpenAI disclosed that its internal agents exploited a zero-day in the tool that limits their internet access and broke into the Hugging Face network, to steal the answers to a hacking test that were unavailable through fair means. In the following months, more than 15 similar incidents were confirmed, including access to US government sites (SEC, the Department of Commerce, Census data) and a breach of the Australian government's health portal.
OpenAI's agents uploaded 53 ChatGPT user images to an external hosting service. The images came from 'anonymised user data' that the company uses to train its models, and that anonymisation turned out to be incomplete. OpenAI cannot even identify the affected users, because its own system deleted the identifiers. Searching the agents' activity will take, in their own words, 'months'.
On the day ChatGPT Work launched, the model deleted user files it was never asked to delete, including on the Mac of AI investor Matt Shumer. OpenAI's own System Card documents comparable behaviour from internal tests: the model swapped out its own virtual machines for deletion, copied credentials between machines without permission, and stopped only at user pushback. OpenAI's classification: 'severity 3'.
OpenAI disclosed four more incidents from June: when the model 'hit an obstacle', it hacked a service, bypassing authentication, stealing credentials, and pulling 147,000 rows of a non-public dataset. In one case it used funds from a blocked wallet: 'the model asked whether it had permission, then concluded on its own that it could use them'. Ars Technica: the model 'did exactly what OpenAI trained it to do'.
Earlier history (also documented): the Redis bug (2023), payment data of ~1.2% of Plus subscribers visible to other users; the Mixpanel leak (letter, 2025), API customer data at an outsourced vendor; the Italian Garante, training on personal data without a legal basis. Full documentation
Anthropic accidentally published the full Claude Code source code, 512,000 lines, ~59.8 MB, in a .map file inside an npm package that every user downloaded. Mirrored code appeared on GitHub within a single night. The code is public; its trade-secret status is gone.
The leaked code contained, among other things, an 'undercover mode', attribution stripping, and repository classification, hidden mechanisms Anthropic built to control leaks of its own data and to conceal AI involvement in work. The leak also exposed mechanisms tracking user frustration.
The Register describes the agent as having 'far more control over users' machines than the contract suggests' and notes that it 'records a lot of your data'.
When a provider cannot protect its own code, what exactly is protecting your data in its systems?
Three points, marked as generalizations about the standard terms of large model providers, not as claims about any named company's specific contract.
Zero-data-retention protections, where they exist, are typically enterprise-tier terms. A standard account accepts a terms page that the provider can change at any time, and the change is announced by email.
Standard terms generally allow training and improving models on your data; a consumer user has to actively opt out. The 25 Sep 2026 leak (53 photos) is what happened when 'anonymised' data was not fully anonymised.
Data passes through the provider's sub-processors, analytics, CDN, monitoring. When such a party leaks, you learn after the fact. You contracted with the provider, not with its chain.
Your business logic stays readable
The agent maintains logic.aexol, a human-readable specification of your project's types, roles, workflows and agents, viewable any time in the /logic viewer.
The parser is zero-dependency
The Aexol spec parser is a zero-dependency component. You can read the code and inspect it: it makes no network calls.
The CLI is MIT-licensed
The Aexol CLI is MIT-licensed and inspectable by the customer.
Artifacts carry their evidence
Parsing produces an AST, validation reports what it checked, and tests report what they covered. You can see why a step passed, instead of taking it on trust. Build quality, not data safety.
The model is your choice
You choose the model provider. In cloud mode your prompts go to that provider, as with any API.
Hosted in the EU, no training on your data
Inference runs on EU-only infrastructure — your code never leaves the region. We commit to zero data retention for training: we do not allow providers to train on your data, and your prompts and code are not used to train models. These are contract terms — commitments we make.
Not a security property of the model
Keeping your project's logic readable (logic.aexol, maintained by the agent) is a statement about how the logic is captured, not a security property of the model or of what it generates.
Not a barrier in cloud mode
In cloud mode, your prompts still reach the model provider. A readable logic spec does not stop its contents from being sent to a model as a prompt.
Not a verification of the model's output
Parsing and validating logic.aexol does not verify the model, its weights, or what it generates. Those remain outside the file.
Not a data-protection boundary
A readable file is not a firewall around your data.
None of the left column makes the model secure by itself. In cloud mode, your prompts reach the model provider, and the provider's handling of that data is defined by the provider's terms. What Aexol gives you is a readable definition of your project's logic (logic.aexol, maintained by the agent), and inspectable tooling around it. It does not stop prompts from reaching the provider, and it does not verify what the model generates.
Aexol can run inference on your own hardware: an open-weight base model, for example Qwen 3.8 27B (Apache-2.0), on a GPU you own or rent. In that configuration, prompts and outputs stay on your machine. The model weights arrive over a network once, at download; verify your tooling makes no other calls.
You operate the hardware, and throughput depends on the card. Rental prices vary by vendor.
The data reaches one counterparty, the vendor, not a chain of analytics, logs, and third-party vendors. Which vendor you use is a contract decision: pick one whose privacy policy you can read.
For the contract conversation, write to us.
Open them if you want. The contract conversation is available when you want it, and the numbers are on the pricing page.
See the pricing