I have had multiple conversations with the cursor devs on their discord about this and there is no way to verify those claims, or even that they respect your ignore rules for secrets.
Yes its an accident waiting to happen
Eventually they will get hacked
And you're working in a context where you're comfortable shipping all your (employer's? client's?) code to some random US company based on their promises?
If you work for a large org you’ll have some kind of enterprise agreement in place guaranteeing this. I can’t imagine they’d risk violating it regardless, the outcry could ruin them
If you work for a large org which has an official AI policy and agreements, sure. In those cases there is no problem; you're sending your employer's code to these companies in compliance with your employer's policy.
You have to trust them because their is no way to verify this claim.
Or not trust them because there is not way to verify this claim.
What does that mean in practice? Will you get your money back if they do?