The AI agent allow list checked 1,413 agent and coding-tool vendors against their own published terms for whether the agent trains on what it sees, dated 18 September 2026.
A chatbot sees what you type. An agent can see a whole repository, a whole screen, or a whole logged-in session.
After a dispute over whether an OpenAI math result used two researchers' private coding-agent sessions, OpenAI's statement was: "While unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models."
That sentence made "does this agent train on what it sees" a question every team running coding agents now has to answer for itself. Full timeline on the incidents page.
Coding agents and agent platforms first, then by domain. A vendor not in this table has not yet been checked in the published register.
Every value below comes from the vendor's own published privacy policy, terms of service or terms of use, read and dated. Click show clause to see the exact sentence and its source link.
| Vendor | Category | Trains on data | Opt-out | Enterprise | API | Checked |
|---|---|---|---|---|---|---|
| Cursor cursor.com | Agents & Automation | No | Yes | Yes | Not stated | 17 Sep 2026 |
| pull requests github.com | Agents & Automation | Trains unless opted out | Yes | Yes | Not stated | 17 Sep 2026 |
| ChatGPT openai.com | Code & Development | Trains unless opted out | Yes | Yes | Yes | 17 Sep 2026 |
| Devin devin.ai | Code & Development | Not stated | Not stated | No | Not stated | 17 Sep 2026 |
| Zapier Central zapier.com | Agents & Automation | Trains unless opted out | Yes | Yes | Not stated | 17 Sep 2026 |
| n8n n8n.io | Agents & Automation | No | Not stated | Yes | Not stated | 17 Sep 2026 |
| browser-use browser-use.com | Agents & Automation | Yes | Not stated | Not stated | Not stated | 17 Sep 2026 |
| Bolt x Figma bolt.new | Agents & Automation | Not stated | Not stated | Yes | Not stated | 18 Sep 2026 |
| Grok API x.ai | Agents & Automation | Yes | Not stated | Not stated | Not stated | 17 Sep 2026 |
| 11.ai 11.ai | Agents & Automation | Trains unless opted out | Yes | Not stated | Not stated | 17 Sep 2026 |
| fx (by Vercel) fx.sh | Agents & Automation | Not stated | Yes | Yes | Not stated | 18 Sep 2026 |
| Pi pi.ai | Agents & Automation | Trains unless opted out | Yes | Not stated | Not stated | 18 Sep 2026 |
| OpenMarket m11.ai | Agents & Automation | Not stated | Not stated | no_tier | no_tier | 18 Sep 2026 |
| Any.do any.do | Agents & Automation | Not stated | Not stated | Not stated | Yes | 18 Sep 2026 |
| omiGPT omi.me | Agents & Automation | No | Not stated | Not stated | Not stated | 18 Sep 2026 |
| VDF AI Networks vdf.ai | Agents & Automation | Not stated | Not stated | No | Not stated | 18 Sep 2026 |
| Ito AI ito.ai | Code & Development | No | Not stated | no_tier | no_tier | 18 Sep 2026 |
| sim sim.ai | Agents & Automation | No | Not stated | Yes | Yes | 17 Sep 2026 |
| Qvio™️ hia.ai | Agents & Automation | Not stated | Not stated | no_tier | no_tier | 17 Sep 2026 |
| Exa exa.ai | Agents & Automation | Yes | Not stated | Yes | Yes | 17 Sep 2026 |
| 11x.ai 11x.ai | Agents & Automation | Not stated | Not stated | Yes | Not stated | 18 Sep 2026 |
| Furl furl.ai | Agents & Automation | No | Not stated | Not stated | Not stated | 18 Sep 2026 |
| Aito aito.ai | Agents & Automation | No | Not stated | No | Not stated | 18 Sep 2026 |
| Gedo gedo.ai | Agents & Automation | No | Yes | no_tier | no_tier | 18 Sep 2026 |
| Plow Latch plow.co | Agents & Automation | No | Not stated | Not stated | Not stated | 18 Sep 2026 |
| Cust cust.co | Agents & Automation | Not stated | Not stated | Yes | no_tier | 18 Sep 2026 |
| Auxx.ai auxx.ai | Agents & Automation | Not stated | Not stated | Yes | Yes | 18 Sep 2026 |
| Aira aira.io | Agents & Automation | Yes | Not stated | no_tier | no_tier | 18 Sep 2026 |
| Awaz.ai awaz.ai | Agents & Automation | Trains unless opted out | Yes | No | Not stated | 18 Sep 2026 |
| Qodo qodo.ai | Code & Development | Trains unless opted out | Yes | Yes | Yes | 17 Sep 2026 |
| Fimo fimo.ai | Agents & Automation | Not stated | Not stated | Yes | Not stated | 18 Sep 2026 |
| Felo felo.ai | Agents & Automation | Not stated | Not stated | No | Not stated | 18 Sep 2026 |
| Enjo.ai enjo.ai | Agents & Automation | No | Not stated | Yes | Yes | 18 Sep 2026 |
| Effy effy.ai | Agents & Automation | No | Not stated | Yes | Not stated | 18 Sep 2026 |
| Kore.ai kore.ai | Agents & Automation | Not stated | Not stated | Yes | Not stated | 18 Sep 2026 |
| Oumi oumi.ai | Code & Development | Not stated | Not stated | Yes | Not stated | 18 Sep 2026 |
| Gong.io gong.io | Agents & Automation | Not stated | Not stated | Yes | Not stated | 18 Sep 2026 |
| Gong.AI gong.ai | Agents & Automation | Not stated | Not stated | Yes | Not stated | 18 Sep 2026 |
| is.team is.team | Agents & Automation | No | Not stated | Not stated | Not stated | 18 Sep 2026 |
| Kilo kilo.ai | Code & Development | Yes | Yes | Not stated | Not stated | 17 Sep 2026 |
A coding agent with repo access can read files a chat window never would: configuration, credentials left in code, internal comments.
A browser agent captures whatever is on screen during a session, including logged-in pages the user never intended to share.
Agents often operate with the same session tokens and API keys as the user, widening what a training exception could actually expose.
Four fields per vendor, with values and a clause on click: trains on data, opt-out available, enterprise tier excludes training, API tier excludes training.
Seven more fields are locked and shown by name, unlocked in the full register.
Regardless of what a vendor's terms say about training, the AI agent allow list keeps agents restricted to approved page types, so a training gap in one vendor's policy is not the only line of defense.
See the page-type database this runs on.
A dated record of what each AI agent and coding-tool vendor's own published terms say about training on what the agent sees: your code, your screen, your files.
A chatbot sees what you type. A coding agent can see a whole repository. A browser agent can see a whole logged-in session. The training question applies to a much larger surface.
On 8 September 2026, after a dispute over whether a math result was reached using two researchers' private sessions, OpenAI said: while unlikely, it cannot rule out that de-identified data derived from their usage of its products helped improve its models.
161 of the vendors checked state they train on submitted data by default, 72 train unless the user opts out, 464 state they do not train, and 716 do not state a position, as of this page's snapshot.
It keeps agents restricted to approved page types regardless of what any individual vendor's terms say, so a training gap in one vendor's policy is not the only control in place.
Seven additional fields, including opt-out scope, feedback exceptions and monitoring retention, are shown by name only here and unlocked in the AI Tools Blocklist register product.
The full register adds opt-out scope, retention, human review and subprocessor training for every vendor above.
