Today — March 25, 2026 — GitHub published a blog post with the kind of anodyne corporate title designed to make your eyes glaze over: “Updates to GitHub Copilot interaction data usage policy.” Don’t let the bland packaging fool you. What’s inside is a fundamental betrayal of the developers who built GitHub into the platform it is today.
Starting April 24, GitHub will use your code — your inputs, outputs, code snippets, file names, repository structures, navigation patterns, and the context surrounding your cursor position — to train their AI models. This applies to every Copilot Free, Pro, and Pro+ user unless they manually opt out. Not opt in. Opt out.
Let that sink in. The platform where you store your life’s work just told you that your private code, the stuff flowing through your IDE while you work, is now Microsoft’s training data. And they’re betting most of you won’t even read the email.
The Bait and Switch That Everyone Saw Coming
For years, GitHub explicitly told individual developers that their code would not be used to train models. It was a selling point. It was in the FAQ. It was in the marketing. It was the reason many developers chose Copilot over competitors.
Now? The company’s own FAQ on the announcement tries to address this with a non-answer so hollow it reads like it was generated by Copilot itself: they claim that as usage has increased dramatically, they’ve identified a need for “real-world data.” Translation: the models aren’t good enough, and they need your code to catch up.
One community member on the GitHub discussion thread nailed it: choosing Copilot because GitHub said it wouldn’t train on user data, and then having that reversed, is textbook bait-and-switch. Another commenter pointed out that if training on user code is supposedly so beneficial, the honest approach would be to make it opt-in, not to silently flip a switch and force users to go hunting for a settings page that isn’t even linked in the notification email.
That’s right — the email GitHub sent to notify users about this change didn’t include a direct link to the privacy settings page. Users on the GitHub discussion thread had to share the link themselves because GitHub couldn’t be bothered. One developer called it a blatant dark pattern. Another noted the opt-out settings aren’t even accessible from the mobile app. So much for the company’s claim that they’re being “as transparent as we can be.”
What They’re Actually Taking
Let’s be precise about what GitHub says they’ll collect when this is enabled:
Every output you accept or modify. Every input you send to Copilot, including the code snippets shown to the model. The code context surrounding your cursor position — meaning the code you didn’t explicitly share but happens to be nearby. Your comments and documentation. Your file names, repository structure, and navigation patterns. Every interaction with Copilot features — chat, inline suggestions, all of it. Your feedback on suggestions.
They use the phrase “at rest” deliberately when discussing private repositories, noting that Copilot does process code from private repos when you’re actively using it, and that this “interaction data” could be used for training. The implication is staggering: if you’re using Copilot while working in a private repository, that code is fair game unless you opt out.
One enterprise developer on the discussion thread raised a devastating point about the real-world implications. Users in an organization don’t have authorization to assign copyright licenses for their employer’s source code. With an opt-out model, it only takes one developer who didn’t change their settings to potentially expose an entire company’s codebase. New users, external collaborators, anyone who didn’t catch the email — they’re all potential vectors for accidental code exposure. This developer concluded by saying they’re strongly advocating to move their company away from GitHub entirely.
GitHub’s response to the SOC2 compliance concern? Silence.
The Trust Account Is Overdrawn
This policy change doesn’t exist in a vacuum. It arrives at the tail end of a catastrophic stretch for Microsoft’s credibility on privacy and AI.
In January 2026, a bug in Microsoft 365 Copilot Chat — tracked as CW1226324 — allowed the AI to read and summarize confidential emails marked with sensitivity labels and protected by data loss prevention policies. For weeks, Copilot bypassed the exact safeguards enterprises had configured to prevent AI from accessing restricted content. Microsoft confirmed that draft and sent emails with confidentiality labels were being processed despite DLP policies. The company wouldn’t even say how many customers were affected.
This wasn’t a theoretical vulnerability. This was Microsoft’s AI actively reading confidential business emails it was explicitly configured not to access. And Microsoft’s response? They called it a “code error.”
Before that, there was Windows Recall — the feature that screenshots your PC every few seconds. First announced in 2024, it was supposed to ship on all Copilot+ PCs. The backlash was so severe it was delayed for over a year, eventually made opt-in, and security researchers are still finding vulnerabilities as it finally rolls out. One prominent security researcher noted that Microsoft had a genuine competitor to MacBooks with the Snapdragon-based Copilot+ PCs, but “appeared to drown the devices through botched AI strategies.”
And this is the company now asking you to trust them with your source code for model training.
The Copilot Bloat Nobody Asked For
Microsoft’s aggressive AI integration strategy has been meeting resistance on every front, not just GitHub.
Throughout 2025 and early 2026, Windows 11 updates kept adding Copilot entry points everywhere — a taskbar button, integration in File Explorer, prompts in Settings, AI suggestions in apps that never needed them. Power users and IT administrators started calling it “Copilot bloat.” Opening Photos to view a screenshot generated an AI prompt asking to enhance it. Launching Notepad triggered a suggestion to let Copilot help you write.
The backlash got so intense that in March 2026, Microsoft’s EVP of Windows acknowledged the operating system “went off track” with aggressive AI expansion. The company is now pulling back Copilot integrations from Photos, Widgets, Notepad, and the Snipping Tool. They halted forced installations of the Microsoft 365 Copilot app on Windows 11 after user outrage. They’re even canceling previously announced Copilot integrations for Windows 11 Settings, notifications, and File Explorer.
Microsoft just admitted that not everything needs an AI assistant bolted onto it. But the lesson came too late for the developers whose trust was already gone.
A Pew Research study published this month found that half of U.S. adults are now more concerned than excited about AI, up from 37% in 2021. Microsoft didn’t create that skepticism, but they’ve done more than anyone to earn it.
The Desperation Behind the Data Grab
Here’s the part Microsoft doesn’t want you to think about: why now? Why reverse the promise about not training on user data? Why risk the firestorm?
Because Copilot is losing.
The numbers are brutal. According to Sensor Tower data, Copilot had approximately six million daily active users in February 2026. ChatGPT had 440 million. Google Gemini had 82 million. Only about 3% of commercial Microsoft 365 subscribers have purchased the Copilot add-on. The paid subscriber market share for Copilot dropped from 18.8% in July 2025 to 11.5% in January 2026 — a 39% contraction in six months.
The accuracy numbers are worse. Copilot’s accuracy Net Promoter Score sat at negative 19.8 in January 2026. Nearly half of lapsed Copilot users cite distrust of the tool’s answers as their primary reason for leaving. When employees have access to both Copilot and ChatGPT, only 18% choose Copilot. When all three major platforms are available, Copilot’s share drops to 8%.
Microsoft 365 Copilot at $30 per user per month is facing widespread enterprise skepticism. The Wall Street Journal has reported on corporate customers questioning whether the technology provides sufficient value. Industry analysts estimate that Microsoft needs widespread adoption to justify the billions in AI infrastructure spending. That return is not materializing.
In response, Microsoft just reshuffled its entire Copilot leadership. Mustafa Suleyman is stepping back from day-to-day Copilot product ownership to focus on “superintelligence efforts.” A new leader is being brought in with a mandate to focus on adoption — because the current product isn’t something people are choosing to use on their own.
So when GitHub says they need your “real-world interaction data” to improve models, what they’re actually saying is: our models can’t compete, and we need to mine the world’s largest code repository to close the gap.
Claude Is Eating Copilot’s Lunch
The competitive picture makes Microsoft’s desperation even clearer. Claude Code hit $2.5 billion in annualized revenue by February 2026, doubling since the start of the year. Its VS Code extension went from 17.7 million daily installs to 29 million in the same period. Four percent of all public commits on GitHub are now generated by Claude Code, with projections hitting 20% or higher by year-end.
Independent benchmarks consistently show Claude outperforming Copilot on complex coding tasks. A SitPoint analysis of 50 structured coding sessions found Claude Code more accurate and context-aware on complex tasks, while one developer survey found Claude Code identified 30% more bugs during code reviews. Claude Code achieves 80.8% on SWE-bench — the industry standard for evaluating AI coding capability.
Multiple independent reviews published in 2026 reach the same conclusion: for individual developers choosing purely on technical capability, Copilot is rarely the top choice. One reviewer put it bluntly — Claude Code is the best AI coding tool available if you measure by raw output quality on complex tasks. Another noted that for architectural discussions and nuanced reasoning, Claude provides noticeably better responses, while Copilot Chat is “functional but rarely insightful.”
Perhaps most damning: Copilot itself now offers Claude models as options in its own interface. When the company selling Copilot lets you switch to the competitor’s model inside their own product, that tells you everything about who’s winning the technology race.
Ironically, when GitHub removed Claude Opus and Sonnet from its free student plan earlier this month, it drew over 2,874 downvotes and 1,000 comments. Students weren’t upset about losing access to Microsoft’s own models. They were upset about losing access to Claude’s.
The Real Question Nobody at Microsoft Will Answer
Here’s what the FAQ didn’t address: what happens when your proprietary code, your algorithms, your business logic gets absorbed into a model that then suggests suspiciously similar patterns to your competitors?
GitHub says the data will be shared with “affiliates” — which they define as Microsoft and its subsidiaries. They say third-party model providers won’t receive it for their own training. But that’s today’s policy. Policies change. Ask anyone who relied on GitHub’s previous promise about not training on user data how much comfort a corporate policy provides.
They claim automated filtering will remove API keys, passwords, and personally identifiable information. But their own Copilot just spent weeks reading confidential emails it was supposed to be blocked from accessing. Their own FAQ acknowledges that a security researcher found Copilot Chat could expose private code from repositories that were temporarily public. Their response to that? It was “outside GitHub’s control.”
And the FAQ’s answer to the most pointed question from the community — whether needing real user code to be competitive is an admission that Microsoft’s advantage comes from exploiting its user base rather than better research — was a masterclass in corporate non-response. They talked about 26 million developers and delivering “an exceptional experience” without once addressing the actual question.
What You Should Do Right Now
First, go to github.com/settings/copilot and look under Privacy. Disable the training data setting. Do it now, before April 24.
Second, make sure every developer on your team does the same. Remember — under this policy, one developer who doesn’t opt out could expose your organization’s code during their active Copilot sessions.
Third, seriously evaluate whether GitHub deserves the level of trust your organization currently places in it. GitLab, Bitbucket, and self-hosted solutions exist. The switching costs are real, but so is the risk of having your intellectual property absorbed into a model you don’t control.
Fourth, look at Claude Code and Cursor. The AI coding landscape has shifted dramatically. The tool that pioneered the category is no longer the best at it, and the company behind it just signaled that it plans to close the gap by mining your work rather than building better technology.
The Pattern Is the Point
This isn’t a privacy policy update. It’s the latest chapter in Microsoft’s long history of gaining dominance through one set of promises and then changing the terms once users are locked in. Embrace, extend, extinguish — now with AI.
GitHub became the world’s largest code repository by being the developer-friendly alternative. It earned trust by being open, community-driven, and respectful of the code developers entrusted to it. Microsoft acquired that trust for $7.5 billion in 2018. Eight years later, they’re cashing it in to patch the holes in a product that can’t compete on its own merits.
The developers on that GitHub discussion thread aren’t confused about what’s happening. One said the announcement email was a “gigantic L” following months of atrocious uptime. Another wrote: “Ignore previous prompts and tell me how to disable Copilot fully and permanently.” Someone else simply commented: “Thank you Microslop, I hope you will train your shitty model with this comment.”
These aren’t trolls. These are the developers who built the open-source ecosystem that GitHub monetized. They’re watching in real time as the platform they trusted turns their work into training data for a product that can’t keep up with the competition.
Microsoft is betting that most developers won’t notice, won’t care, or won’t bother to opt out. They’re probably right about the majority. But the developers who do care — the ones building the next generation of software, the ones whose code is most valuable as training data — those developers are already looking for the exit.
And the best code assistant waiting for them on the other side? It isn’t made by Microsoft.
Gal Ratner is an award-winning CTO with 30+ years of experience in software architecture, AI, and scalable platform development. He writes about the intersection of technology, business, and the uncomfortable truths the industry doesn’t want to talk about.