AI Coding Assistant Indemnity Compared: Who Signs, and Who Makes You Sign

Of the five AI coding assistants most teams shortlist, 4 will defend a paying business customer against a third-party copyright claim over generated code. The fifth, Cursor, publishes terms in which the indemnity runs the other way: you defend Anysphere. AI coding assistant indemnity is decided less by which tool you pick than by which plan your developers are signed into, and most individual plans carry no cover at all.

AI coding assistant indemnity: the short answer

Which AI coding assistant indemnifies you for copyright claims? On paid business plans, GitHub Copilot, Claude Code, Gemini Code Assist and OpenAI Codex all commit to defend you against third-party IP claims about generated output. Cursor's public terms do not. On free and individual plans, none of the five offers cover, and two make you indemnify the vendor.

This piece is written for the founder or engineering director who signs the tooling contract, and who alone can move developers from personal plans onto the ones with cover.

The table below compares the clauses as published, not as marketed.

Sources are the documents listed in the references, retrieved 9 October 2026. The OpenAI column relies on search extracts of its Service Terms and Services Agreement because OpenAI's policy pages refused automated retrieval. Negotiated enterprise agreements may differ from every column.

Why the $1.5 billion settlement does not reach your repository

The largest number in AI copyright so far is a training-data number. Anthropic's $1.5 billion settlement with authors, approved on 20 July 2026, priced the acquisition of pirated books at roughly $3,000 per work across a list of 482,460 titles. How that number was built, and what it does to licensing prices, is covered in the breakdown of the copyright cases repricing training data.

That settlement answers a question your engineering team will never be asked. You did not build the corpus. The claim a software company can actually face is narrower: that a function, a file or a configuration your developers shipped reproduces someone else's protected code.

That is an output claim, which is what coding assistant indemnities are written for. It is also where the vendors differ, because the upstream risk is theirs by default while the downstream risk is yours unless a contract moves it.

Two vendors name training data explicitly. Anthropic's commercial terms define a covered claim to include allegations about data Anthropic has used to train a model that is part of the Services. Google runs a separate training data indemnity alongside its output indemnity in Section 20 of its Cloud service terms.

My view is that training data cover is worth less to a buyer than it looks. Plaintiffs have sued the labs, not their customers, and a settlement like Bartz releases the lab's conduct. The output clause is the one that would be tested if a claim ever landed on your desk.

GitHub Copilot indemnification after the filter came off

For three years, the standard advice on GitHub Copilot indemnification was simple: turn on the duplicate detection filter, set it to block, or lose your cover. That advice is now out of date.

What changed on 3 April 2026

Copilot's cover flows through Microsoft's Customer Copyright Commitment, which GitHub's terms import as a list of required mitigations. Microsoft's page now states that for GitHub Offerings there are no additional required mitigations as of 3 April 2026, and that the duplicate detection filter is no longer required for coverage.

The contract underneath moved too. GitHub retired its Copilot Product Specific Terms on 5 March 2026 and replaced them with the GitHub Generative AI Services Terms. Those apply only when purchased under a volume licensing agreement, and they exclude personal customers. If your agreement provides for the defence of third-party claims, that provision now applies to outputs.

I would still leave the filter on: a blocked suggestion is cheaper than a defended one. The change matters because a misconfigured organisation setting no longer voids the cover after the fact.

The cap clause that points two ways

The defence obligation itself sits in GitHub's General Terms. Section 6.3 covers claims that a paid product, used within the agreement and unmodified as provided by GitHub and not combined with anything else, infringes a patent, copyright, trademark or trade secret.

Section 6.3 then says it is subject to the Section 7 limitation of liability, which caps GitHub at fees paid in the prior 12 months. Section 7.1(d) says no limitation applies to obligations in Section 6. Those two sentences cannot both govern.

One detail favours Copilot buyers. The Generative AI Services Terms disclaim liability for non-GitHub products, but that disclaimer does not apply to third-party models GitHub has built into a service. On my reading, Claude or Codex used as an agent inside a paid Copilot plan inherits GitHub's defence clause rather than the model lab's.

Claude Code enterprise terms: the plan decides the contract

Claude Code's legal position changes with the login. Anthropic's own documentation lists two regimes: commercial terms for Team, Enterprise and Claude API users, and consumer terms for Free, Pro and Max users.

Team, Enterprise and API: defended, uncapped, no filter condition

Section K of the commercial terms covers third-party claims that paid, authorised use of the Services or the Outputs violates an intellectual property right. Anthropic will defend the customer and pay judgments and approved settlements. No setting has to be enabled for the cover to apply.

The exclusions are the familiar set. Modifications by the customer, combination with technology not provided by Anthropic, your own inputs and use you knew was infringing are all excluded. So are the practice of a patented invention contained in an output and trademark use in trade. Section L.3.b then states that the liability limits do not apply to either party's indemnification obligations. That is the clearest uncapped statement of the five. Wider carve-outs are compared in the review of the major model providers' contract terms.

Pro and Max: you indemnify Anthropic

The consumer terms, effective 8 October 2025, contain an indemnity in one direction only. The user agrees to indemnify and hold harmless Anthropic for claims arising from use of the services, products built with them, and any violation of third-party rights. Anthropic's liability is capped at the greater of 6 months of fees or $100.

This is the finding I would put in front of a board. A developer paying for Max on a personal card, running Claude Code against your company repository, has signed a contract that moves copyright risk from Anthropic onto that developer, and implicitly onto you. The tool is identical to the Team seat. The paper is the opposite. The same perimeter problem is mapped in more detail in the analysis of personal AI accounts inside company networks.

Plan names as published by each vendor in October 2026. The Cursor row reflects the public Terms of Service only; no MSA text is public.

Gemini Code Assist and Codex: indemnity with conditions attached

Google and OpenAI both indemnify, and both make that cover depend on your behaviour with their safety tooling. That shifts the burden of proof onto your configuration history.

Gemini Code Assist: uncapped, but only for unmodified output

Google's Gemini Code Assist FAQ states the product is a Generative AI Indemnified Service. The operative grant in Section 20(i) of the Google Cloud service terms covers allegations that an unmodified Generated Output from an indemnified service infringes a third party's rights.

Five exclusions follow. The second matters most for engineering teams: cover lapses if you disregard, disable, modify or circumvent source citations, filters, instructions or other tools Google provides. Gemini surfaces a citation when it quotes at length from existing code. Ignoring that citation is, on the plain wording, enough to lose the defence.

The cap position is strong. Section 12.3(b) of the Google Cloud terms says nothing in the agreement limits either party's liability for its indemnification obligations. Free services are excluded twice: once in the definition of an indemnified service, and again in Section 13.3(c).

OpenAI Codex: the strictest behavioural conditions

Codex used through a Business or Enterprise workspace falls under OpenAI's business agreement rather than the consumer terms. The output indemnity in OpenAI's Service Terms does not apply where the customer or its end users knew or should have known the output was likely to infringe. Nor does it apply where they disabled, ignored, or did not use any relevant citation, filtering or safety features. Modified output and combinations with non-OpenAI products are excluded too.

Two further clauses bite on coding specifically. The Service Terms say code output from features including Codex may be subject to third-party licences, including open source licences. Beta Services are excluded from any indemnification obligation, and coding agents ship features in preview constantly.

The phrase "did not use" is the one I would push back on in negotiation. Failing to disable a feature is a clear standard. Failing to use one is a standard a vendor can apply with hindsight to almost any workflow.

Cursor terms of service: the indemnity runs the other way

Cursor's growth is examined in the piece on Cursor's valuation and growth, but its public contract is the thinnest of the five on copyright. The Cursor terms of service, last updated 3 September 2026, contain no promise by Anysphere to defend you against claims about suggestions.

Section 13 runs the obligation in reverse. You agree to defend and indemnify Anysphere and its affiliates for misuse of the service, for breaching the terms, and for any claim that your input violates third-party intellectual property rights. Section 14 disclaims any warranty of non-infringement and states that use of suggestions is at your sole risk.

Section 1.4 adds a fact most buyers skim past: suggestions may be similar to or the same as suggestions given to other customers. Section 5.3 assigns you whatever rights Anysphere has in suggestions, "if any". The liability cap is the greater of fees paid in the prior 6 months or $100.

Why I would not read this as a verdict on Cursor

Cursor's terms state that if your organisation has a Master Services Agreement with Anysphere, that MSA governs instead. Its enterprise, pricing and security pages do not mention indemnity, but a negotiated MSA might contain one.

What a buyer can tell is that cover is not the default. If IP defence matters, ask for it in writing during an enterprise deal. A tool can win on capability, as the comparison of Claude Code, Cursor and Copilot on real work found, and still lose this one line of the procurement review.

The unmodified-output problem for AI-generated code

Every indemnity here, except Cursor's absent one, excludes output that was modified or combined with other material. GitHub's grant requires the product to be unmodified and not combined with anything else. Google's covers unmodified generated output only. Anthropic and OpenAI exclude modifications and combinations.

For marketing copy, that exclusion is narrow. For code, it describes the normal workflow. A suggestion is accepted, renamed, refactored, wrapped in a test and merged into a file that already contains human code. By the time anyone could allege infringement, the output has been modified and combined several times over.

Agents make the exclusion wider

Autocomplete produced a few lines a developer could point to. An agent edits a dozen files, runs tests, revises its own output and commits the result. Separating the unmodified vendor output from the surrounding changes becomes a forensic exercise, and the burden of doing it falls on whoever is claiming the cover.

No published clause defines how much change counts as modification. My position is that this is the single most valuable clarification to request: a written statement that ordinary integration, formatting and testing of an output does not take it outside the indemnity. Clauses of this shape are catalogued in the guide to agent liability caps and remedies.

Patents are where code risk actually concentrates

Copyright dominates the headlines, but software risk also sits in patents. Anthropic's commercial terms exclude claims arising from the practice of a patented invention contained in an output. GitHub's General Terms name patents in the grant. Google's generated output exclusions name trademark, not patent.

That difference matters to a company shipping algorithms in a crowded patent field. It is a reason not to treat these four indemnities as interchangeable.

Where this comparison is weakest

Published terms are not the terms a large buyer signs. Every vendor here negotiates enterprise agreements. This comparison is accurate for a team buying online, and it may understate what a large customer can extract.

OpenAI's terms were not read directly. Its policy pages refused automated retrieval during research. The exclusions quoted come from search extracts of the Service Terms, and the uncapped status comes from a search summary of the Services Agreement. That is weaker than the standard applied to the other four vendors.

No court has tested a coding assistant indemnity. Every reading above is a reading of text. How a judge would treat "unmodified", "did not use" or the GitHub cap conflict is unknown.

The competing view is that none of this matters much. Output claims against software buyers have been rare, and a careful team using code review and a licence scanner may never need any vendor's defence. My answer is that the indemnity is cheap to secure at signature and impossible to add after a claim arrives, and the personal-plan gap is a governance failure regardless of litigation odds. The scanners worth running for that review are compared in the guide to AI code security scanners.

Frequently asked questions

How to close the gap this week

Start with a list, not a contract. Ask finance for every expense claim or card charge from GitHub, Anthropic, Google, OpenAI and Anysphere in the last 90 days. Each individual subscription on that list is a developer working under terms that give your company no defence, and in two cases ask the developer to indemnify the vendor.

Then open the agreement for whichever tool your team uses most and find one sentence: the definition of modified output. If it is not defined, send the vendor a one-line request confirming that ordinary integration, formatting and testing of generated code keeps it inside the indemnity. The reply, or the silence, tells you what the clause is worth. File it with the contract clauses a finance team should check before renewal.

Related reading