Defense AI: Using CUI Documents, Code and Other Files

Last updated: November 12, 2026

This article is for teams who want to give Defense AI material that contains CUI or proprietary data: earlier proposals, reports and other reference documents, or source code, secrets and other repository content used with coding agents such as Claude Code, Codex and OpenCode. It explains who could ever access that material, and what can cause it to leave the Defense AI path.

Short answer

When your team uses Defense AI correctly, the material you share goes from your managed computer to your company's gateway and models in your own cloud account, and the response comes back the same way.

  • Atomus doesn't see the content.

  • OpenAI and Anthropic don't receive it, even when you use apps they make, such as Claude Code or Codex.

  • Microsoft or Google, who run the models in your account, may keep content their abuse monitoring flags, and authorized provider staff may review it, until your company is approved for an exemption. We recommend every company applies. See Defense AI: Data Retention, Who Sees Our Data, Is it Used for Training.

Who could access the material

Who

Access to your documents, code and drafts

Your company

Anyone with access to the computer, files or accounts where they're saved

Atomus

None. Atomus sees usage totals only (requests, tokens, cost)

OpenAI and Anthropic

None for the models Defense AI offers. Some Claude models on Google Cloud (the Fable and Mythos families) require sharing with Anthropic; ask your Atomus contact before turning one on

Microsoft (Azure)

Flagged content may be kept up to 30 days and reviewed by authorized Microsoft staff, until you're approved for modified abuse monitoring

Google (Claude add-on)

Flagged prompts may be kept up to 90 days and reviewed by authorized Google staff, until you have an exemption

Outside vendors

Only if someone sends content to them, for example through a vendor connector, web search, or by copying output into their system

What can reach the model

Anything you paste, attach or open can go to the model. If you use a coding agent, assume anything the agent reads or runs ends up in the model's context, including:

  • Files it opens, including files your .gitignore excludes

  • Output from commands it runs, including commands that print environment variables, logs or config

  • Secrets in .env files, config files, shell history, or cloud and SSH credential folders

  • Git history, diffs and branch names

  • Results from connectors and tools it calls

Don't rely on .gitignore alone. It stops commits, not reads. Keep secrets in a secret manager or credential store, not in files inside the repository, and don't paste them into prompts. If a secret was pasted or read by an agent, rotate it. It may now be in local transcripts, and in provider abuse-monitoring storage if it was flagged and your exemption isn't in place yet.

Risks on your side

These AI tools have risks. Weigh the pros and cons as an organization, and set a company policy that fits your risk profile. Some companies use the tools with few restrictions; others are more cautious. Defense AI doesn't prescribe one approach.

Through Defense AI: only as described in the short answer above.

Through other channels your team controls:

  • MCP servers and vendor connectors. Anything in the conversation can be sent to a connected tool. Vendor connectors (for example Grain, Quo, Pylon, HubSpot, Linear or Notion) are not approved for CUI.

  • Web fetch and web search. These send addresses and search terms outside your environment, and a tool may build them from your documents, code or prompts. Based on your company's risk profile and policy, and depending on the AI tool, you can turn them off or require approval for each use.

  • Commands with network access. An agent that can run curl, git push, package publishing or issue-tracker commands can send data wherever those commands reach. Based on your company's risk profile and policy, you can keep approval prompts on for shell commands, file writes outside the project, and network access, or allow modes such as "skip permissions", "full auto" or "never ask".

  • Output in other systems. Commits, pull request text, CI logs, tickets, chat messages and copied drafts carry whatever was written. If they leave your CUI boundary, so does the content. Treat generated code, docs and comments that contain CUI as CUI, and keep code review and secret scanning in place.

  • Other AI features in your editor. Built-in AI chat, agents and completion in some editors, such as Cursor's own features, go through that vendor's servers, even if you've set a custom model. Use the Claude Code extension instead on CUI repositories.

Use these tools only on a managed device in your company's CMMC scope. That includes remote dev boxes, VMs and test hardware a coding agent works on over SSH.

For Claude Code setup details, see Defense AI: Using Claude Code. To call the gateway from your own scripts, see Defense AI: Calling the API from Your Own Code.

Related articles: Defense AI: Data Retention, Who Sees Our Data, Is it Used for Training · Defense AI: Can We Use It for CUI or ITAR Data? · Defense AI: Microsoft 365 and Third-Party Connectors · Defense AI: Security Controls · Defense AI: Using Claude Code