Two Tools, One Underlying Problem

Claude Code (Anthropic) and GitHub Copilot (Microsoft/OpenAI) are the two dominant AI coding assistants in enterprise engineering organizations. They differ in interface, model quality, and integration depth. They share one critical property: both transmit your code to external servers.

This comparison covers what each tool sends, how each handles that data, where the enterprise security risks differ, and why mutation addresses the core exposure for both.

What Gets Sent to the Server

Claude Code

Claude Code operates as a terminal-based agent with full filesystem access. In a typical session, it reads multiple files to build context, then sends that context as part of the prompt to Anthropic's API. A refactoring request for a single function might send the entire file, adjacent imports, and type definitions to construct a useful response.

The context window for Claude Opus 4 is 200,000 tokens. A large codebase context will hit that ceiling. In practice, Claude Code sends whatever it judges necessary to answer the question, which can be substantially more than the developer expects.

What gets transmitted: function bodies, class definitions, variable names, import paths, inline comments, type definitions.

What stays local automatically: only the files Claude Code leaves unread. Everything that Claude Code reads to build context is a candidate for transmission.

GitHub Copilot

Copilot operates inline in the IDE, completing code as the developer types. It sends a smaller context window per request: typically the current file, the cursor position, and nearby open files. Individual completions carry less context than Claude Code agent sessions.

Copilot also offers Copilot Chat, which behaves more like Claude Code: the developer can reference files explicitly, and Copilot builds context from them for multi-turn conversation.

What gets transmitted per completion: current file content, open file snippets, cursor position.

What gets transmitted in Copilot Chat: referenced file content, conversation history.

Data Handling: What Each Vendor Promises

Anthropic (Claude Code)

Anthropic's enterprise agreement includes a data processing addendum that covers Claude API usage. Key terms for enterprise customers:

• -Prompts stay out of model training by default on the API (as distinct from the Claude.ai consumer product)
• -Data is processed in transit and at rest using AES-256
• -Anthropic employees can access data for safety and abuse review
• -Data retention is 30 days for abuse monitoring, then deleted

The 30-day window and the employee access provision are the two items enterprise security teams most commonly flag. The 30-day retention means a prompt containing proprietary identifiers is retained on Anthropic's infrastructure for up to 30 days after transmission. The employee access provision means human review of prompts is contractually permitted.

Microsoft/OpenAI (GitHub Copilot)

Copilot Business and Enterprise include contractual protections that go beyond the consumer product:

• -Code suggestions stay out of GitHub Copilot model training when the enterprise policy is set to block training
• -Microsoft's enterprise agreement covers data processing under GDPR
• -Code sent to Copilot is processed through Azure OpenAI Service, covered by Microsoft's standard data processing terms

The training opt-out is the critical control. The default for individual accounts is training enabled. Enterprise accounts with the correct policy setting are excluded. Confirming this setting is configured correctly across an organization takes administrative review; verify it directly.

Where the Security Risks Differ

Claude Code: Higher Context Volume

Claude Code's agent model means more code leaves the machine per session. When a developer asks Claude Code to refactor a payment processing module, Claude Code will likely read the entire module, its dependencies, and related test files. The context window is large enough to contain meaningful portions of a codebase in a single request.

For organizations with highly concentrated IP (a trading algorithm, a fraud detection model, a proprietary routing engine), Claude Code's high-context approach increases the surface area per request.

Copilot: Training Data Risk

The training data risk is higher with Copilot because the default for individual accounts is training enabled, and enterprise organizations frequently have a mix of enterprise-licensed accounts and individual accounts. A developer who also uses a personal Copilot account from a work machine may be using an account where training data collection is active.

The enterprise policy controls apply to licenses managed through the organization's GitHub plan. Personal accounts sit outside them. If your organization has shadow AI usage through personal Copilot accounts, those sessions are outside your contractual protections.

Both Tools: Prompt Privacy Rests on Promises

The contractual protections both vendors offer are meaningful, and they are promises; a technical control is a separate layer. You are trusting:

1. -That the vendor's infrastructure stays secure
2. -That the vendor honors the contractual terms
3. -That the internal access policies the vendor claims are enforced
4. -That the default settings you relied on remain the defaults

Technical controls work by design and ask for less trust. With mutation, even if all four of these assumptions fail, the attacker sees only synthetic identifiers that carry meaning solely inside your organization.

The Mutation Solution: One Fix for Both Tools

Pretense runs as a local proxy between the developer's IDE and any LLM API endpoint. Because both Claude Code and Copilot can be configured to use a custom API base URL, Pretense intercepts both:

# For Claude Code
export ANTHROPIC_BASE_URL=http://localhost:9339

# For Copilot (OpenAI-compatible)
export OPENAI_BASE_URL=http://localhost:9339

Before the prompt reaches Anthropic or Microsoft's servers, Pretense:

1. -Extracts code blocks from the prompt
2. -Scans identifiers (functions, variables, classes, interfaces) and detected secrets, API keys, and tokens
3. -Replaces each with a deterministic stand-in: getUserToken becomes _fn4a2b
4. -Stores the mutation map locally
5. -Transmits the mutated prompt

After the LLM responds:

1. -Pretense scans the response for synthetic identifiers
2. -Swaps each identifier back byte-exact: _fn4a2b becomes getUserToken
3. -Keeps secrets as stand-ins by design, so a prompt-injected model has only a placeholder to exfiltrate
4. -Returns the response with real code names to the developer

The developer sees real code names. The LLM API received only synthetics. Proprietary identifiers stayed on the developer's machine.

This approach works identically for Claude Code and Copilot because it operates at the transport layer, below the tool level. When a new AI tool joins the developer's workflow, the proxy already covers it, so the team skips a fresh security review.

Feature Comparison for Security Teams

Recommendation

For security teams evaluating enterprise AI coding tools, the choice between Claude Code and Copilot matters less than having a technical control layer in place. Both tools present real IP exposure risks. Both risks are addressed by mutation at the transport layer.

Deploy both tools if your developers are most productive with both. Protect both through Pretense. The audit log covers all providers in a single trail.

How I run Pretense on my own code

I build Pretense with Claude Code, and my sessions run through it. Here is the setup I give a new engineer, in order.

1. -Run the agent through the proxy. Type pretense run claude where you would type claude. It starts a local proxy on port 9339, points Claude Code at it and stops the proxy when the session ends. Detected secrets and PII leave the laptop as stand-in tokens.
2. -Put hooks on every repo. pretense install adds a pre-commit and a pre-push hook. A key that never lands in git is a key an agent never reads.
3. -Scan before an agent reads the repo. pretense scan path . lists what it finds. In CI, pretense scan ci exits 0 when clean, 2 on findings and 3 when it examined nothing. Treat 3 as a failure.
4. -Preview the swap. pretense review . shows what would be mutated. pretense mutate <file> --preview prints one file mutated and leaves the file on disk as it was.
5. -Round-trip a file you need to share. pretense mutate <file> --map <map> swaps the secrets in place. pretense reverse <file> --map <map> turns it back into the original, byte for byte, from the encrypted map on your machine. We run that round trip on real files before every CLI release and compare sha256 hashes.

One thing I learned the hard way: inside a session the agent sees stand-ins, so a file the agent writes can hold a stand-in where you expected a real value. Grep what the agent wrote before you ship it.

What Pretense will not do is put a secret back into the model's answer. Code identifiers come back byte-exact. Secrets and PII stay as stand-ins in the response. That is deliberate: a prompt-injected model can echo a token into a link, and reversing it there would hand over the real key.

What this means if you buy security

The outcome: your engineers keep their AI coding tools, and detected secrets and PII leave each laptop as stand-in tokens.

• -The control sits on the endpoint. The swap runs on the developer's machine before the request leaves. No shared gateway holds every team's keys.
• -You get evidence, not a memo. pretense audit --format csv exports every mutation event. Add --framework SOC2 to keep only the events that map to that framework.
• -Check it on your own code. Detection is pattern and entropy based, and coverage varies by data type. Run pretense review . on a real repo and read what it catches before you sign off.
• -Start with one team. One repo, pretense run claude, one week. Then read the audit log with the team lead.

Try it on your own repo: create a free account, then run npm i -g @pretense/cli and pretense run claude. If you need a security review first, talk to me.