Does my code get uploaded anywhere?

The agent loop, your files, and your project memory stay on your machine, and your API key never leaves the app. What an agent puts in a prompt does go to DeepSeek, under your own key — that's how any hosted model works. The difference is that there is no AutoCoder server in between, so we never see your code or your key.

What will this actually cost me per month?

Two things, and you should count both: the subscription (₹0 on the free tier for 50 queries, ₹899/month for unlimited) plus your own DeepSeek token spend, billed directly by DeepSeek at their rates. A typical task on V4 Flash lands in the low single-digit cents. Run /total_cost in Telegram at any time for the running total.

Do I have to leave my computer on?

Yes — and awake. AutoCoder runs the orchestrator in-process on your desktop; Telegram is the remote control, not the runtime. Tasks you send from your phone queue on that machine and execute there, so if it sleeps or you shut the lid, the run pauses until it wakes. Before scheduling anything overnight, set the machine not to sleep. That's the honest trade for keeping your code and your key local — there is no cloud runtime to fall back on.

Which platforms are supported?

Windows desktop today, via the Microsoft Store. It's a young project — if you're on macOS or Linux, the honest answer is "not yet."

Do I need my own DeepSeek API key?

Yes — it's required, not optional. You paste it into the app once and pay DeepSeek list price directly. We don't resell tokens, bundle credits, or take a cut, which is why there's no markup to explain.

What happens when an agent gets it wrong?

Two of the five agents exist for exactly that: the Verifier runs typechecks, tests, and local Semgrep packs and loops back on failures, and the Reviewer produces line-level findings with severity levels. You still get a grouped diff to read before anything ships. And /cancel stops a running task from your phone.

Can I keep it from doing things I don't want?

Persistent project rules live alongside the repo and are re-read on every task, so conventions stick without repeating them in each prompt. You also control the thinking budget — how many tokens the model may spend reasoning — and whether a task runs on all five agents or just one.

The reviewer emits structured JSON with per-line annotations, severities, and fix suggestions, which GitHub Actions, GitLab CI, and Jenkins parse natively. Scheduled tasks return the same grouped diff a chat-box run does, so you review it before anything ships.

Why not just use Claude Code or Cursor?

Often you should. They're pair programmers — excellent when you're at the keyboard, reviewing as you go, with stronger models behind them. AutoCoder is for the other case: work you want to hand off entirely. If you want to be in the loop on every edit, use theirs. If you want the work done while you're doing something else, use ours.

Is the 6-digit access key safe?

It rotates every 7 days automatically, and you can force a new one at any time with /access_key. It authenticates your desktop app to your own Telegram account — it is not your DeepSeek key, which never leaves your machine.

Can I write prompts in a language other than English?

Yes — prefix a prompt with @regional and you'll get research-backed answers in 22 Indian languages, at the same price as English. No surcharge, no separate tier.

AutoCoder.dev

Download for WindowsDownload

#Data Poisoning

Posts tagged Data Poisoning.

All AI2#Data Poisoning

Prompt Injection Is #1 in OWASP's 2026 GenAI Top Ten

Research verified against current sources (OWASP GenAI 2026 release, the USENIX Security 2026 paper, the CISPA/ACL 2026 study, TaintP2X, and OWASP's RAG cheat sheet).

Devdatta Narawade3 August 20269 min