In terms of compliance in the EU in a microsoft heavy shop, this is the closest thing we get to a "safe" coding agent and it isn't safe at all. It can run cloud only, but then it kind of sucks. I think the cloud only stuff is going to need to work better or we're going to need dedicated machines to run agents on where the device itself has very limited access. In those contexts I'm not too worried about them. Well, at least not about them being a supplychain risk, but they'd still be a risk to others if they had internet access (and since they're run by us, we'd be liable.)