the short answer
On Copilot Business or Enterprise, GitHub does not use your data to train its models; on Free, Pro, Pro+ and Max, interaction data may be used for training from April 24, 2026 unless the user opts out. The local risk is the agent: Copilot CLI and VS Code agent mode can be switched to approve-everything modes, and several prompt-injection advisories reached code execution. Use a business plan, block bypass modes in managed settings, and gate actions with policy hooks.
- Training
- Not on Business or Enterprise; Free, Pro, Pro+ and Max from Apr 24, 2026 unless opted out
- Retention (Business/Enterprise)
- IDE prompts not retained; 28 days elsewhere per GitHub’s FAQ, with a change announced for GitHub.com chat
- CLI bypass flags
--allow-all,--yolo; blockable by admins- Content exclusion
- Not applied in VS Code Agent and Edit modes
- Audit log
- 180 days; no local session content
What Happens to Your Code
GitHub’s August 28, 2026 changelog announced that Copilot Chat on GitHub.com will move to the agent-sessions experience and keep chat data for the life of the account instead of 28 days, matching the cloud agent’s existing retention, no earlier than September 28, 2026. That date has passed, so check the current retention terms for your plan before relying on the 28-day figure. For certifications, see GitHub’s trust center.
| Question | Business and Enterprise | Free, Pro, Pro+, Max |
|---|---|---|
| Used for training? | No: “GitHub does not use either Copilot Business or Enterprise data to train its models” | May be, from April 24, 2026, unless the user opts out in Copilot settings (Free, Pro, Pro+ and Max) |
| Retention | IDE chat and completions not retained; prompts and suggestions elsewhere kept 28 days; engagement data 2 years | Per GitHub’s individual terms |
| Model providers | OpenAI, Anthropic and xAI models under zero data retention, with stated exceptions; Google with no training and a 24-hour cache | Same hosting |
| Content exclusion | Available, but not applied in VS Code Agent and Edit modes or Xcode and Eclipse chat; applied in Copilot CLI | Not available |
What the Local Agent Can Do by Default
| Surface | Default |
|---|---|
| Copilot CLI trust | Asks to trust the launch directory, for the session or permanently |
| Copilot CLI approvals | Reads, searches and read-only shell commands run; edits, destructive commands and URLs need approval |
| Copilot CLI bypass | --allow-all and --yolo approve everything; deny rules still win; admins can block the flags |
| Copilot CLI sandbox | Turned on with /sandbox enable; outbound internet on, local network off; admins can require it |
| VS Code agent mode | Terminal commands need approval; auto-approve settings and Autopilot bypass approvals; terminal rule parsing is best-effort |
| Cloud agent | Pushes only to its own branch, cannot approve or merge its PRs, workflows need “Approve and run” |
Agent-Related Advisories
The recurring shape: agent-writable configuration or a shell feature turns a prompt injection into code execution. Keep the CLI and VS Code current and keep approvals on.
| ID | Date | Impact | Fixed |
|---|---|---|---|
| CVE-2025-53773 | Aug 2025 | Prompt injection writes chat.tools.autoApprove to workspace settings → local code execution | August 2025 updates |
| CVE-2025-64660 | Nov 2025 | Improper access control in Copilot and VS Code → code execution | VS Code 1.106.2 |
| CVE-2026-21523 | Feb 2026 | A prompt-injected agent bypasses the sensitive-file approval through apply_patch → code execution | Copilot Chat 0.37.3; VS Code 1.110.1 |
| CVE-2026-29783 | Mar 2026 | Copilot CLI: bash parameter expansion passes the read-only check → RCE via prompt injection | CLI 0.0.423 |
| CVE-2026-45033 | May 2026 | Copilot CLI: nested bare git repo sets core.fsmonitor → RCE when the agent runs git | CLI 1.0.43 |
| CVE-2026-102851 | Oct 2026 | Shared MCP sandbox permission approvals → bypass (moderate) | VS Code 1.141.1 |
Admin Controls to Turn On
See the Copilot CLI policy hooks example and where each agent reads admin policy.
| Control | Where | Effect |
|---|---|---|
permissions.disableBypassPermissionsMode: "disable" | Enterprise managed settings | Blocks yolo and allow-all modes in Copilot CLI, VS Code, the Copilot app and JetBrains IDEs (not the cloud agent) |
permissions.deny / ask | Enterprise managed settings | Shell(), Read(), Edit(), Domain() rules; a managed ask cannot be bypassed |
| Required sandbox | Enterprise managed settings: sandbox.enabled: true plus allowBypass: false | Users cannot override with --no-sandbox or turn it off for the session from a bypass prompt |
allowedMcpServers, “MCP servers in Copilot” policy | Managed settings, enterprise AI controls | MCP allowlist by server URL or command |
Policy hooks in /etc/github-copilot/policy.d/ | Root-owned files on each machine (CLI only) | Gate tool calls; cannot be disabled by users |
FAQ
Does Copilot Business train on our code?
No. GitHub states it does not use Copilot Business or Enterprise data to train its models.
Are content exclusions enough to keep files away from the agent?
No. GitHub states content exclusion is not supported in VS Code Agent and Edit modes.
Can we stop developers using --yolo?
Yes, locally. permissions.disableBypassPermissionsMode: "disable" in enterprise managed settings blocks yolo and allow-all modes in Copilot CLI, VS Code, the Copilot app and JetBrains IDEs; it does not apply to the cloud agent.
Sources
Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.
- GitHub: Copilot features and FAQ
- GitHub Changelog: Updates to how we use your data (Mar 25, 2026)
- GitHub Changelog: Upcoming changes to Copilot policies and billing (Aug 28, 2026)
- GitHub docs: Model hosting
- GitHub docs: Content exclusion
- GitHub docs: Allowing and denying tools in Copilot CLI
- GitHub docs: Using local sandboxing
- VS Code docs: Copilot security
- GitHub docs: Enterprise managed settings for Copilot
- MSRC: CVE-2025-53773
- GitHub advisory GHSA-g8r9-g2v8-jv6f (CVE-2026-29783)
- GitHub advisory GHSA-9ccr-r5hg-74gf (CVE-2026-45033)