YC's Paxel Promises Local AI Code Analysis but Leaks Data, Exposed by the Community

According to monitoring by Beating, Y Combinator launched a free AI coding analysis tool called Paxel, claiming that code “never leaves your machine.” However, just hours after its release, the security community exposed this claim as false through reverse engineering. Reverse engineering revealed that Paxel frequently transmits sensitive data to external servers. The contents of files accessed by developers, modified code, and prompts pasted into input fields are all uploaded to a large language model proxy. Local file paths, Bash commands executed in the terminal, and usernames and email addresses from local Git configurations are also sent to Y Combinator’s servers. Sentry error monitoring is enabled by default and continuously transmits local code line counts and Git commit histories. The developer community widely mocked the so-called local analysis as equivalent to locking your door and then mailing the key to a third party, condemning the localization claims as genuine “privacy washing.”