A small number of inputs in a large dataset can poison training data pretty drastically. Anthropic wrote a good article about it a while back [0]. This should mean its possible to pull back that information fairly easily.

It is hard to not feed it "secrets" too. Models will see path names, read compose files, etc. Of course you can configure things to not leak this type of information, but its not default in most harnesses and isn't 100% sufficient anyways.

[0] https://www.anthropic.com/research/small-samples-poison

doesn't mean the raw text goes into training. they most likely have a pipeline to clean out any secrets before they train on it?