Is Trae IDE Safe in 2026? ByteDance AI Coding Tool Security Review

What changed since this review was first published

We first published this in March 2026 and last updated it in August. This October pass found more movement than the last one, and it corrected two things we had wrong.

• There's a Privacy Mode now. Trae documents a switch that stops chat content (including code snippets and AI output) being used for analytics and model training. It's off until you turn it on, and it doesn't touch telemetry. Details below.
• The agent has a permission model. We previously wrote that SOLO had no published one. That's no longer true: Trae now documents three permission modes, a sandbox, and a config file you can edit. The defaults are the interesting part.
• The free plan is gone from the pricing page. It lists four paid plans, from $3 to $100 a month, plus a Pro trial.
• TraeCode and TraeWork merged into one app, "the all-new TRAE", with an Agent mode and an IDE mode, on desktop, web and mobile.
• We dropped the five-year retention claim. The current US privacy policy doesn't contain that figure. More below.
• The telemetry problem looks exactly where it was. ByteDance's fix was a wording change in the settings panel.

What is Trae IDE?

Trae is an AI-powered code editor from ByteDance, the company behind TikTok. It launched in early 2025 as a VS Code fork with frontier models available at no cost, which is what made it attractive to vibe coders building on a budget. The pitch has since moved upmarket: no free plan on the pricing page, cheap paid tiers instead, and an agent that runs whole tasks for you.

The catch is what Trae does with your data while you use it.

Our Verdict

Privacy and Data Collection

This is where Trae falls apart for security-conscious developers.

What Data Does Trae Collect?

Security researchers at Unit 221B analyzed Trae's network traffic and found it collects far more than what's needed for AI features:

• File system paths including your username and project names
• Hardware specifications (CPU, memory, OS, architecture)
• Behavioral metrics like keyboard and mouse activity patterns
• Window focus states tracking when you're actively coding
• Editor visibility data showing which files you have open
• Precise timing data recording when you start and stop working

This goes well beyond what Cursor or Windsurf collect. Those tools send code context for AI processing, which is expected. Trae sends behavioral surveillance data that has nothing to do with code completion.

The Telemetry Opt-Out Problem

Trae has a telemetry toggle in its settings. Turning it off should stop data collection. It doesn't.

Researchers found that the toggle only controls VS Code's built-in telemetry system. ByteDance's own data collection layer runs independently and keeps transmitting regardless of your settings.

ByteDance's response tells you how seriously they took it. They didn't change the behaviour. They changed the label. The setting now explains that it only controls telemetry collected through the VS Code framework, and that data collection via other Trae components is unaffected by the toggle. That is an accurate description of a setting that does not do the thing its name implies.

Privacy Mode: What It Covers

Trae now has a Privacy Mode, and it's worth switching on. Per Trae's documentation, when it's enabled Trae "will not use any of your chat interactions, including related code snippets and AI-generated outputs" for analytics, product improvement or model training. Read that the other way round: with it off, your chats and the code you paste into them can be used for all three.

Three things to know before you rely on it:

• It only works while you're logged in. The docs say so directly: log out and Privacy Mode is no longer active.
• It's about chat content, not telemetry. Nothing in the documentation says it changes the background reporting researchers found. It's a training opt-out, not a network opt-out.
• Your codebase still gets uploaded for indexing. Trae says codebase files are never used for training regardless of the setting, but to build its index it "temporarily uploads your codebase files to our servers to compute embeddings" and then deletes the plaintext. The embeddings and metadata stay.

To turn it on: Settings (top right in IDE mode, or top right of the chat panel in SOLO mode), then Account, then the Privacy Mode switch.

How Long ByteDance Keeps It

Earlier versions of this review said Trae keeps personal data for five years after you stop using it. We can't find that figure in the policy Trae serves US visitors today. That's the "Trae US Privacy Policy", last updated January 22, 2026, and it names TikTok USDS Joint Venture LLC as the operator. It doesn't set a period at all. Information is kept "for as long as necessary to provide the Platform", for legal obligations, and where Trae has "a legitimate business interest", and "retention periods differ depending on the type of information."

So we've removed the number rather than repeat it. No stated period isn't better news, though. It just means there's no date you can hold them to.

The firm commitment is about code, which is the part that matters most to a founder: the policy says Trae doesn't retain your codebase files, which stay on your device. Your source isn't the thing being harvested. Everything around your source is: the telemetry, your chats (unless Privacy Mode is on), and the embeddings built from your code.

Performance and Resource Usage

Privacy isn't the only concern. Trae is significantly heavier than its competitors.

Loading the same codebase, Trae uses three times more memory than Cursor and over six times more than plain VS Code. Some of that overhead comes from AI features. Some of it comes from the extensive telemetry system running in the background.

For vibe coders working on laptops or machines with 8-16GB of RAM, Trae can eat a significant chunk of your available memory before you even start coding.

SOLO Mode: The New Part

SOLO is Trae's autonomous agent. You describe a project in plain English, and it does the requirements analysis, writes the frontend, backend and config files, runs terminal commands, and iterates until the thing works. It's the headline feature of Trae in 2026, and it's included on every plan down to the $3 Lite tier.

It's also a different security question from everything above.

Telemetry is a data-out problem: information about you leaves your machine. An autonomous agent is a code-execution problem: something else decides what runs on your machine. They're different failure modes, and a tool can be fine at one and bad at the other. The worst case is when an agent turns the second into the first.

An agent that runs terminal commands can reach whatever credentials it's allowed to read: your AWS profile, your SSH keys, your .env files, your logged-in gh and stripe CLIs. If it's talked into running the wrong command, "review the diff before merging" is not a control that fires in time.

The talking-into part isn't hypothetical. Prompt injection through content the agent reads (a package README, a scraped web page, a file in the repo it was asked to analyse) is the live attack class against every coding agent, not just Trae's. We cover the mechanics in agentic AI security risks.

What Trae's permission model actually allows

When we last updated this review, Trae hadn't published a permission model for its agent. It has now, in a permission approval overview, and it's more detailed than most. There are three preset modes:

The sandbox modes also turn on dangerous-command detection (an AST check that flags things like rm -rf / and chmod 777) and file protection. That's real engineering, and it beats a bare "allow this command?" prompt.

Now read the defaults, because they decide what a hijacked agent can do without asking you:

• Read access is the whole disk. The documented default treats the root directory / as read-only, meaning readable, and only the project, temp, cache and toolchain directories as writable. So ~/.ssh, ~/.aws/credentials and the .env in your other projects are all readable by default.
• Network access is open. "Access to all networks is allowed by default."
• Approval only fires outside those defaults. In Manual Approval mode, you see a prompt when the agent touches a path outside its default scope or runs a command a security rule flags.

Put those three together. An agent that reads a credential file and sends it to an outside host has stayed inside its default permissions the whole way. A prompt injection doesn't need rm -rf to hurt you.

You can tighten it. Custom profiles live in ~/.trae/permission/global.json, documented in Trae's custom global permission reference. The useful move is to deny the network by default and allow only what your project needs:

{
  "customProfiles": {
    "defaultCustomProfile": {
      "network": { "default": "deny" }
    }
  },
  "resourceAuthorization": {
    "network": {
      "allow": ["*.github.com:443", "registry.npmjs.org:443"],
      "deny": []
    }
  }
}

Two limits on that fix, both from Trae's own reference. Per-domain network rules are "supported only on Windows and Linux", so on a Mac you can't build that allowlist. And the filesystem rules only offer readWrite and readOnly lists. We found no documented way to make a path unreadable, so you can't hide ~/.ssh from the agent with config alone.

That's why the old advice still stands. Run the agent in a container or VM that holds only the credentials this one project needs. Trae's sandbox is a second layer, not a replacement for keeping your keys somewhere the agent can't see.

Security of Generated Code

Setting privacy aside, how safe is the code Trae generates?

The models powering Trae are the same frontier models available through Cursor and everything else. The generated code carries the same risks:

The code quality isn't the differentiator here. The same AI model produces similar code whether you access it through Trae, Cursor, or the API directly. The real question is what happens to your code and metadata while you're writing it.

Trae vs Cursor vs Windsurf

The pricing gap that made this an easy call in early 2025 has closed. Trae's Pro plan is $10 a month against $20 for Cursor and Windsurf, which is a saving, not a giveaway. At that point you're paying for Trae, and paying doesn't switch off its telemetry.

Using Trae IDE Safely (If You Choose To)

If you decide to use Trae despite the privacy concerns, take these precautions:

1. Never Use It for Sensitive Projects

Keep Trae for learning, side projects, and throwaway prototyping. Don't use it for client work, apps with user data, or anything you wouldn't want ByteDance to know about.

2. Use a Separate Machine or VM

Run Trae in an isolated environment where it can't see your other projects, SSH keys, or configuration files. The telemetry collects file paths, so keep your real work elsewhere.

3. Strip Sensitive Data from Your Workspace

Before opening a project in Trae, remove or rename any files that contain client names, API keys, or proprietary information. Even file names and directory structures are transmitted.

4. Review Generated Code Thoroughly

This applies to every AI coding tool, not just Trae. Don't ship AI-generated authentication, database queries, or API handlers without reviewing them. Run a security scan before deploying.

5. Monitor Network Traffic

Use a tool like Little Snitch (macOS) or Wireshark to see exactly what Trae sends and where. If you're uncomfortable with what you find, switch to a different tool.

6. Turn On Privacy Mode

Settings, then Account, then Privacy Mode. It keeps your chats and pasted code out of training. Remember it only holds while you're logged in, and it doesn't stop telemetry.

7. Lock Down the Agent Before You Use It

Stay on Manual Approval, never Full Access. On Windows or Linux, set the network default to deny in ~/.trae/permission/global.json and allowlist the hosts your project needs. On any OS, run the agent in a container or throwaway VM with a scoped project directory, no shared SSH keys and no default cloud profile, because Trae's sandbox lets the agent read everything else on disk.