# Trae Security on Mac: Monitor Network Access with FireAI > What can be verified about the Trae AI coding tool, and how to watch its network connections on a Mac with FireAI: 3-day learning, new-destination flags and upload spikes. FireAI Security & Research Team (HisnLabs) · Published 2026-10-04 Canonical: https://hisnlabs.com/en/blog/monitor-trae-network-mac-fireai Trae is an AI coding tool whose site presents it under the tagline "Collaborate with Intelligence". Searches such as "is Trae safe" and "Trae data exfiltration" are common because people want to know what an AI editor sends out of their machine. This article is deliberately short on claims about Trae itself: the vendor pages could only be read in part for this article, and everything below that describes Trae is limited to what was readable. ## What Trae is The official site lists two products: TraeCode, described as "Your 10x AI Coding Engineer", and TraeWork, described as "Your Professional AI Work Assistant". TraeWork has a web version, and both have downloadable versions ([trae.ai](https://www.trae.ai/)). The documentation page for the IDE is titled "What is TraeCode?" ([docs.trae.ai](https://docs.trae.ai/ide/what-is-trae)). > **Note:** Unverified for this article: the operating company named on the site, the platforms each download supports, the permission model for terminal commands, the privacy policy details and any list of domains. The privacy and documentation pages are rendered by script and did not return their body text to the tools used. Read them directly before relying on any claim about Trae. ## What an AI coding agent can generally reach A coding assistant that edits projects and runs commands has, at minimum, the file access of the account that starts it, and it needs the network to reach model services. That is a property of the category, not a documented fact about Trae, but it explains why a connection-level view is useful whatever the vendor says. ## Watching Trae with FireAI FireAI is a firewall for macOS that runs on your Mac. Its [Agent profile](https://hisnlabs.com/en/docs/agent-profile) feature recognises 19 AI agents, Trae among them, and identifies Trae by the app it runs from. FireAI then learns where that app normally connects. For every recognised agent it works the same way, using only metadata (host names and byte counts); FireAI never reads the payload of a connection. 1. For the first 3 days FireAI learns the destinations Trae normally contacts, grouped by domain: api.anthropic.com becomes anthropic.com. Nothing is flagged during this learning period. 2. After that, a destination outside the learned baseline is flagged for review in Suggestions, in the AI agents card and in Quick Review. Swipe left to block, or right for "It's fine". 3. An upload spike is flagged too: an hour in which the agent uploaded at least 4 times its busiest hour so far, and never less than 25 MB. ## Set up monitoring for Trae, step by step 1. Install and open FireAI, then use Trae as you normally would for a few days so the 3-day learning period has real traffic to learn from. 2. Open Suggestions and look for the AI agents card. Flags from agents also appear in Quick Review, the card stack you swipe through. 3. To keep the agent to the places it already uses, choose Agent profile in the security mode menu, next to Home, Coffee shop, Paranoid and Under attack. Once the agent has finished learning, a connection to a destination outside its baseline is blocked instead of being flagged. Your own allow rules still win, and DNS and your local network are never blocked. 4. When something is blocked, the AI agents card offers Allow and Keep blocked. Allow adds the destination to the baseline; Keep blocked creates a block rule, so the destination stays blocked in every mode. 5. For a precise rule, open Rules and click Add rule: choose the app, then Allow or block, then a website, a domain with its subdomains, an IP address or a range, and how long it lasts. 6. To understand a single connection, open Threats and use Investigate, or choose Investigate from a line on the World map. The page shows a risk score, the reasons behind it and what FireAI saw. > **Note:** The Agent profile mode needs FireAI 1.0.3 or later, and the 19-agent list needs 1.0.4. Version 1.0.2 flags new destinations but does not block them. ## Limits - FireAI cannot see prompts, the contents of tools, file access such as ~/.ssh, or skills. TLS hides the payload, and FireAI is not inside Trae. - FireAI does not stop prompt injection. It limits the damage by flagging, and letting you block, the path data would take out of your Mac. - During the 3-day learning period nothing is flagged, and in the Agent profile mode nothing is blocked while an agent is still learning. Upload spikes are flagged, never blocked. - Agents matched by app, path or script name are labelled, not verified: only Claude Code, Claude and Cursor are checked against their developer's signature. - Child processes that exit very quickly may be missed, and they are matched by path, not by signature. - FireAI shows which hosts Trae contacts and how much it uploads. It cannot tell you why, or what the data contained. The full feature description is on the [Agent profile documentation page](https://hisnlabs.com/en/docs/agent-profile). > Trae's privacy details are hard to read from the outside. Its connections on your Mac are not. [Download FireAI for Mac](https://hisnlabs.com/en/download) Other agents in this series: [Claude Code](https://hisnlabs.com/en/blog/monitor-claude-code-network-mac-fireai), [Claude desktop app](https://hisnlabs.com/en/blog/monitor-claude-desktop-app-network-mac-fireai), [Cursor](https://hisnlabs.com/en/blog/monitor-cursor-network-mac-fireai), [ChatGPT Mac app](https://hisnlabs.com/en/blog/monitor-chatgpt-mac-app-network-fireai), [OpenAI Codex CLI](https://hisnlabs.com/en/blog/monitor-openai-codex-cli-network-mac-fireai), [OpenClaw](https://hisnlabs.com/en/blog/monitor-openclaw-network-mac-fireai). The catch-all guide for every other agent is [Every other AI agent on your Mac](https://hisnlabs.com/en/blog/monitor-any-ai-agent-mac-python-node-fireai). ## How FireAI and HisnLabs fit in When a tool's data handling is hard to verify, watching its connections is something you can do yourself. FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its FireAI Pilot feature) on real traffic patterns, all without any of it leaving your Mac. You can read the technical decisions behind it, or try FireAI for 17 days, at [FireAI, by HisnLabs](https://hisnlabs.com/en/download). ## Sources - [TRAE: official site](https://www.trae.ai/) - [TRAE documentation](https://docs.trae.ai/ide/what-is-trae) - [FireAI docs: Agent profile](https://hisnlabs.com/en/docs/agent-profile) - [FireAI docs: Rules](https://hisnlabs.com/en/docs/per-app-rules) - [FireAI docs: Security modes](https://hisnlabs.com/en/docs/security-modes) - [FireAI docs: Answer your first connection prompt](https://hisnlabs.com/en/docs/answer-your-first-connection-prompt) - [FireAI docs: Investigate a connection](https://hisnlabs.com/en/docs/investigate-a-connection)