Security · 2026-09-16 · 1:34

When AI tokens are "free", your data is the payment

Name: When AI tokens are "free", your data is the payment
Uploaded: 2026-09-16
Duration: 1 min 34 s
Description: The rule of thumb: never send code or prompts you would not post publicly through an endpoint you cannot name. Free tokens are rarely the expensive part.

A popular tip is to route your AI coding through free providers that promise near-unlimited usage. The quiet part: your prompts and source code then pass through third-party endpoints you neither chose nor control.

In favour

For throwaway, public experiments the trade may be acceptable.
Being explicit about where your prompts go is itself good hygiene.

Worth watching

Prompts and code can carry secrets, client data and infrastructure detail — routing them through unknown providers is a confidentiality risk, not a saving.
'Free' at scale often means your data is the product, and may breach the providers' own terms.

Our takeThe rule of thumb: never send code or prompts you would not post publicly through an endpoint you cannot name. Free tokens are rarely the expensive part.

Source: Prompted by a Claude Code plugin roundup

← All Focus posts

AI-narrated · AI-generated content

Transcript

A popular tip is doing the rounds. Route your AI coding through free providers that promise near-unlimited usage. It sounds like a saving. So what does free actually cost? Here is the quiet part. When you take that route, your prompts and your source code pass through third-party endpoints. Endpoints you neither chose nor control. That is the real trade. When the tokens are free, the payment is not money. The payment is your data. To be fair, there is a case for it. If an experiment is throwaway, and public anyway, then the trade may be acceptable. And the question itself is useful. Being explicit about where your prompts go is good hygiene in its own right, whatever you end up deciding. Now the part worth watching. Prompts and code can carry secrets, client data and infrastructure detail. Routing them through unknown providers is a confidentiality risk, not a saving. And there is a second question. Free, at scale, often means your data is the product. And it may breach the providers' own terms. So here is our rule of thumb. Never send code or prompts you would not post publicly through an endpoint you cannot name. Free tokens are rarely the expensive part.