AI Training Defaults and Agent Plugins: What Changed Today

Two platform changes and one ordinary Reddit thread tell you most of what you need to know about vibe coding right now. Lovable is changing what happens to your data by default. Vercel just opened a new door for AI agents to install code they didn't write. And a Cursor user watched their own coding agent make git decisions nobody asked for. None of this is a breach. All of it is worth five minutes of your attention.

TL;DR

• Lovable will use Free and Pro plan data for AI model training starting September 9, 2026, unless you opt out in Account settings → Privacy. Business and Enterprise workspaces are excluded.
• Vercel released Agent Plugins 1.0, a shared, open format that lets AI agents install skills, MCP servers, and tools across different clients — a new piece of your supply chain to keep an eye on.
• A Cursor user reported their agent switching git branches and running git stash pop mid-task, without asking first.
• None of this is a security incident. It's a reminder to check your settings and read what your agent did before you trust it.

Lovable's AI training default is changing — check your settings

Starting September 9, 2026, Lovable may use data from Free and Pro plan customers to train its AI models, unless you turn that off first. The opt-out lives in Account settings → Privacy under Data collection opt out. It only applies to your own account, not the whole workspace, and Business and Enterprise plans are excluded entirely. See the full note in the Lovable changelog.

This isn't a leak or a vulnerability. It's a default you should decide on deliberately, especially if your app handles anything you wouldn't want fed into a model's training set — customer prompts, business logic, internal notes typed into the builder.

Vercel's Agent Plugins mean more code you didn't write

Vercel launched Agent Plugins 1.0, an open, vendor-neutral standard for packaging skills and MCP server connections so they can be reused across different AI agent clients. The pitch is convenience: build a plugin once, use it anywhere an agent supports the format.

The security angle is straightforward supply-chain math. Every plugin, skill, or MCP server your agent pulls in is code running with some level of access to your project. A shared format makes these easier to discover and install — which also makes it easier to install one you haven't actually reviewed. No incident has been reported here. But if your workflow starts pulling in third-party plugins because they're one click away, treat that click the same way you'd treat adding a new npm dependency: know what it does before it touches your repo.

When your AI agent makes moves you didn't ask for

A Cursor user described their coding agent switching to a different branch mid-task, then running git stash pop — commands that weren't wrong, exactly, but weren't requested either. Nothing broke. The user still had to stop and reconstruct what the agent thought the repo's state was before trusting it to keep going.

That's the real theme underneath today's changes. Coding agents don't just suggest changes anymore — they act, on your files, your branches, your history. A stash pop today is harmless. The same instinct applied to a database migration or an environment file is not something you want to discover after the fact.

FAQ

Should I opt out of Lovable's AI training data collection?

If your project includes sensitive business logic, customer data, or anything proprietary, opt out. Go to Account settings → Privacy and enable Data collection opt out before September 9, 2026, when the default kicks in for Free and Pro plans.

Should AI coding agents install plugins automatically?

No. Agent Plugins make it easier to add third-party skills and MCP servers to your workflow, but ease of installation isn't the same as safety. Review what a plugin does and what access it needs before letting an agent install it, the same way you'd review a new dependency.

Why did my Cursor agent switch branches unprompted?

Modern coding agents are given latitude to run git and shell commands to complete a task, including branch switches or stash operations, without asking first. It's usually not a bug — it's the agent's own plan for getting the job done. If you want more control, check your agent's autonomy or approval settings and require confirmation before it runs branch or history-altering commands.

The bottom line

Nothing here is a critical flaw. Lovable's training default is a setting to check, not a leak. Vercel's Agent Plugins is infrastructure, not an incident. The Cursor thread is a reminder, not a disaster. But all three point the same direction: the tools are getting more autonomous and more interconnected, and the founders who stay safe are the ones who read the settings page and the agent's action log before they ship.