What to settle before cloud coding agents work on your code

Last checked: 21 Oct 2026. The vendor facts below come from Anthropic's Claude Code documentation, OpenAI's Codex documentation and Cursor's documentation and data-use pages, with independent framing from the NCSC, Meta and published security research.

A cloud coding agent clones your repository onto a vendor's machine, runs commands without asking and can usually reach the internet. Before one works on your code unattended, settle where code and prompts go, the training terms, how secrets reach the agent, what it can connect to, how it reaches internal systems, what self-hosting changes and what you can audit. Claude Code on the web, Codex cloud and Cursor cloud agents answer each differently, and each vendor's documentation is silent somewhere. Below is what each vendor's own pages say, without ranking them.

Why unattended runs change the question

Cursor says its cloud agent auto-runs terminal commands and that auto-running introduces data exfiltration risk through prompt injection. OpenAI lists code or secret exfiltration among the risks of agent internet access, and Anthropic's security page says no system is completely immune to all attacks.

The NCSC's view is that prompt injection may never be totally mitigated, so the job is to reduce risk and impact with deterministic safeguards and enough logging to spot suspicious activity. Meta's Rule of Two and Simon Willison's lethal trifecta reach the same test: an agent that reads untrusted input, holds private data and can send data out needs supervision or tighter limits. A cloud coding agent typically has all three. Each decision below either removes one of them or limits the damage.

The three products side by side

Sources linked below, checked 21 Oct 2026. "Not stated" means the pages we read do not say.

Where your code and prompts go

Claude Code on the web clones your repository into an isolated VM that Anthropic manages, and Anthropic stores the session transcript under the retention policy for your account type. Claude accesses only the repository where you start the session. When the CLI uploads a local repository, uncommitted changes to credential-like files such as .env are left out on macOS, Linux and WSL, but not on native Windows.

Codex cloud gives each task its own isolated workspace in a VM, checks out the GitHub repositories you select, and keeps saved VM state for up to seven days after the last turn. It respects the repository permissions of the connected source system. An older Codex Cloud (Legacy) experience, due for deprecation, behaves differently in places, so check which one your team uses.

Cursor cloud agents run in isolated VMs inside Cursor's AWS infrastructure, in a separate AWS account from its other production systems. Cursor says Cloud Agents are the only Cursor feature that requires it to store code, and that they are optional if your policy prohibits that. Conversations are kept indefinitely by default (Enterprise can choose 90 days), and snapshots go after 30 days unused. An agent can only reach repositories the triggering user could already reach.

Training and retention terms

The plan a developer signs in with matters as much as the product. Anthropic does not train on Team, Enterprise or API use by default, but trains on Free, Pro and Max accounts when the user's setting is on, including their Claude Code use. Commercial retention is 30 days as standard. Cloud sessions need server-side storage of conversation history, so organisations with Zero Data Retention, the HIPAA configuration or customer-managed encryption keys cannot use them.

OpenAI's Codex pricing page states no training on business data by default for the Business plan. The pages we read state no position for Plus or Pro, and no retention period for Codex cloud tasks, so check the terms of the plan your developers use.

Cursor says Cloud Agents are available in Privacy Mode and that it never trains on your code, retaining it only to run the agent. Privacy Mode is on by default for Enterprise teams. Most models run under Cursor's zero-data-retention agreements, but a few require retention with the provider, so model choice can change the position, and Cursor's data use page says data that triggers abuse detectors may be stored for investigation. Cursor offers US-only data residency today, with EU and UK coverage for inference only, on request. We did not check residency for the other two here. Our UK data residency guide covers the wider question.

Cursor's terms page now lists its own Terms of Service alongside separate subscription terms from SpaceX Super Intelligence (SpaceXSI), following Cursor's announcement on 14 Aug 2026 that SpaceX had acquired it. Confirm which terms govern your contract while those arrangements settle.

Secrets: what the agent can read

All three vendors separate a value the program reads from a credential attached to outbound requests by a proxy. The second keeps the raw key away from anything a prompt injection could print or send.

• Claude Code on the web. Environment variables are readable by anyone who uses the environment. A network secret is added by Anthropic's agent proxy after the request leaves the VM, so the key stays outside it. On Enterprise only an organisation admin can manage network secrets, and they are unavailable with customer-managed encryption keys. GitHub credentials never enter the session's VM, and your branch protection rules decide what a session can push.
• Codex cloud. Environment variables are passed directly to programs. A network secret gives programs a placeholder and the proxy substitutes the real value for allowed HTTPS destinations. Saving an environment-owned network secret adds its destination to the allowed list, and personal values are visible to the task. Tasks in a shared environment use its VPN identity.
• Cursor cloud agents. A Runtime Secret is redacted from tool results, the transcript and commits, but Cursor's network and secrets page says it still loads as an environment variable and is visible to anyone using the agent's terminal. Redaction governs what is recorded, not what the process can use. Build Secrets reach only the Docker build. Agents can also mint short-lived OIDC tokens, valid for five minutes, instead of using stored keys.

For all three, give the agent the narrowest credential that does the job, prefer proxy-attached or short-lived credentials, and keep production keys out. Our guide to setting up Claude Code safely covers the local side.

Network egress: what the agent can reach

Claude Code on the web has four levels: None, Trusted, Full and Custom. The default is Trusted, which allows package registries, GitHub and cloud SDKs. At any level, some paths bypass the allowlist: GitHub through its own proxy, MCP connectors you enable, hosts on network secrets, and the Anthropic API. Anthropic notes that with network access disabled, Claude Code can still reach its API, which may allow data to exit the VM. There is no organisation-wide allowlist, though an Owner can share one environment with a Custom list.

Codex cloud has an Allow Codex to access internet switch, with a package managers preset, custom domains or unrestricted access. The page does not state the default. OpenAI's security cookbook advises leaving it off unless the workflow needs it.

Cursor cloud agents have internet access by default, with three modes: allow all, default domains plus your allowlist, or allowlist only. Cursor's own services and source control providers stay reachable in every mode. The setting can be locked, but a lock does not reach self-hosted machines.

An allowlist is only as tight as the domains on it. One independent researcher has published 2025 cases where data left through DNS commands in local Claude Code, diagram rendering in the Cursor editor and an allowed API domain in the Claude app's code interpreter. None involved the cloud products, and they illustrate mechanisms, not relative risk.

Private access to internal systems

Anthropic's cloud environments page describes no VPN, tunnel or private-network option for Anthropic-hosted sessions. The documented route is a self-hosted environment, where sessions run inside your network.

Codex cloud reaches internal APIs and registries through a VPN connection. Tailscale is currently the supported provider, others are planned, and OIDC is available by request for Enterprise workspaces.

Cursor's network page says cloud agents cannot access resources behind your corporate firewall by default. Its setup page documents Tailscale in userspace mode or Cloudflare Tunnel, and Enterprise workspaces can use AWS PrivateLink or Cloudflare Tunnel.

Does self-hosting change anything?

It moves execution and the checkout. Prompts and what the model reads still go to the vendor.

Anthropic's self-hosted environments are in public beta on Team and Enterprise, off by default and unavailable with Zero Data Retention. Checkouts, build artefacts and secrets stay on your machines. The conversation, including prompts, responses and tool results, goes to Anthropic, which stores the transcript, and the control plane stays Anthropic-hosted. Connector traffic goes through Anthropic's API. Egress control becomes your job, and any member of your Anthropic organisation can dispatch a session to any environment.

Cursor's Self-Hosted Machines move tool execution to a machine you manage. The checkout, build cache and local credentials stay with you, but Cursor runs the agent loop, inference and planning, and the worker sends Cursor the file contents, terminal output and diffs the agent needs. Cursor says it is not an on-prem product. Network and secret settings for Cursor-hosted agents do not carry over. Our post on self-hosted Cursor agents goes further.

For Codex cloud, the documentation we read describes no customer-hosted cloud runner. OpenAI's self-managed Codex options run on your own CI or devices, which is a different arrangement.

Audit logging: what you can prove afterwards

Anthropic says all operations in cloud sessions are logged for compliance and audit, but does not say what a customer can retrieve. The customer route it documents is OpenTelemetry export, with prompt text redacted unless you enable it. Cloud sessions need server-managed settings, because device settings do not reach them. Commits from a cloud session link back to the session.

OpenAI names its Compliance API as the surface for auditable records and says its analytics are not raw audit logs. Whether Codex cloud task events are included is not stated, so ask. Codex Cloud is off by default for Enterprise workspaces, and cloud environments do not inherit device policy or MDM settings.

Cursor's Enterprise audit logs record who changed what, such as sign-ins, roles, API keys and Cloud Agent environments, and never carry prompts, agent output or generated code. Cloud agent logs can go to your own collector through OpenTelemetry export on Enterprise. More Cursor detail is in Cursor cloud agent security.

For all three, branch protection and human review of each pull request remain the controls you own. Our post on AI coding governance covers audit design.

What to settle before the first unattended run

1. Write down which data classes may go to which tools, as DORA recommends, before choosing a vendor.
2. Put every developer on a commercial plan, because personal plans can carry different training terms.
3. If you rely on Zero Data Retention with Anthropic, note that Claude cloud sessions are unavailable to you.
4. Move credentials out of environment variables into proxy-attached secrets or short-lived tokens, one service each.
5. Set egress to the narrowest level that works, then list the paths that bypass it.
6. Scope VPN or tunnel identities to the named systems each task needs.
7. Treat self-hosting as moving execution, not prompts or inference.
8. Confirm the plan you buy provides the audit evidence you need.

Common questions

Do cloud coding agents train on our code?

It depends on vendor and plan. Anthropic does not train on Team, Enterprise or API use by default, but trains on Free, Pro and Max accounts when the user's setting is on. OpenAI states no training on business data by default for Codex on the Business plan and states no position for Plus or Pro. Cursor says it never trains on your code in Privacy Mode, though a few models require retention with the provider.

Where does our code go when a cloud coding agent runs?

Into a VM the vendor runs. Anthropic clones your repository into an isolated VM and stores the session transcript. Codex cloud uses an isolated workspace in a VM and keeps saved VM state for up to seven days. Cursor uses isolated VMs on AWS, keeps the conversation indefinitely by default and deletes snapshots after 30 days of inactivity.

Should we give a cloud agent our API keys as environment variables?

Avoid it where you can. Claude Code on the web and Codex cloud both offer network secrets that a proxy attaches to outbound requests instead. Cursor's Runtime Secrets are redacted from transcripts and commits but still load as environment variables, and Cursor offers short-lived OIDC tokens as an alternative to stored keys.

Can a cloud coding agent reach our internal systems?

Only through a route you set up. Anthropic documents no private-network option for Anthropic-hosted sessions, only self-hosted environments. Codex cloud supports a Tailscale VPN. Cursor cloud agents can use Tailscale in userspace mode or Cloudflare Tunnel, and Enterprise workspaces can use AWS PrivateLink.

Does self-hosting keep our code and prompts inside our network?

Not entirely. Claude self-hosted environments keep checkouts and secrets on your machines, but prompts, responses and tool results still go to Anthropic. Cursor's Self-Hosted Machines keep the checkout with you, but Cursor runs inference and receives the file contents the agent reads. The Codex documentation we read describes no customer-hosted cloud runner.

If you want to know how your own repositories, secrets and network would sit with any of these tools before an agent runs unattended, start with a diagnostic. For setup work, see our AI implementation service and Request a Quote, or go straight to the vendor pages for Claude, OpenAI and SpaceXSI and Cursor.