A coding agent that runs on your laptop still usually sends code and prompts to a model service over the network, and a hosted agent also runs commands in the provider's environment. Trace both paths: where the model runs, where commands run, where data is stored, and for how long.
Two things that get confused
Where the agent program runs. On a laptop, in a container you manage, or in a provider's cloud.
Where the model runs. Almost always a hosted service, unless you run a model yourself.
A tool can be local on the first and hosted on the second. "Runs locally" often describes the program, not the data path. Ask about both.
The data paths to trace
| Question | Local agent, hosted model | Hosted agent |
|---|---|---|
| Where do commands execute? | Your machine | Provider environment |
| What leaves your network? | Prompts and file context | Prompts, files, and the repository copy |
| Whose credentials does it use? | Yours, on your machine | Credentials you hand to the provider |
| Where are logs kept? | Partly local, partly provider | Provider, plus your own if exported |
| Who patches the runtime? | You | Provider |
OWASP lists proprietary source code and security credentials among the data at risk of sensitive information disclosure, and suggests clear retention and usage policies. Those policies are what you need from the provider in writing.
Questions to put in writing
- Which data is sent: prompts only, whole files, or repository copies?
- How long is it stored, and who can access it?
- Is it used for training, and can that be turned off for your organization?
- In which regions is it processed?
- What isolation exists between customers in hosted execution?
- What logs can you export?
- How are security issues in the tool reported and fixed?
Get the answers in the contract or a security document, not a chat reply. For a longer list, see AI coding assistant security questions for vendors.
Choose by data sensitivity
For low tier repositories, a hosted agent with solid answers may be fine. For high tier code, you may prefer a local agent with a model option that keeps data within your boundary, or no agent at all. Match the choice to your repository tiers.
What hosted agents change in your threat model
You hand over credentials, usually a token to your git host. Scope it to the repositories in scope and no more, and prefer short lived tokens. The agent runs without your direct view, so action records and a human review before merge matter more.
What local agents change
The agent inherits your whole environment. Run it with the permission limits in the permission matrix, and prefer a clean environment.
Do not assume, verify
Test with canary data in a scratch repository and watch the network from the machine. What you observe beats what any brochure says.
Safeguard offers asset discovery, an MCP Guardrail and agent identity, which help you see and scope what agents connect to.
Quick check
Does local mean private?
Not by itself. The program may be local while prompts and file context still go to a hosted model.
Is a hosted agent less secure?
Different, not worse by default. It trades control of the environment for the provider's operations, so the written answers matter more.
Sources
Last reviewed: 19 October 2026.
