I was wide-eyed at this, and then I realized that I don't own a laptop either! I have owned a few, but after my last one died 5+ years ago I've just been using my 10 year old desktop computer which doubles as a home server. I do have a work laptop, but I don't own it.
That is the correct way of thinking, never trust anything with your passwords.
I was curious on what haveibeenpwned does, so I took a look at what the network tab in dev tools said what was actually sent. When I type a password (say password123) and press check it runs a function that hashes with the "SHA-1" hash function and then sends the first 5 characters of the result. The response is over a thousand lines in the format of
35 hash characters:number of breaches
If any of these hashes are the start of your original hash, you now know it's exposed and how many times it's been exposed.
Your computer is basically sending a part of your password (the first five characters of a hash) and if the server responds positively to a match it sends all the other possible combinations and your computer looks to see if it matches the rest based on when you typed.
Anyone working in software development should be aware that the employment contract most probably contains a non-disclosure clause that forbids to hand business secrets like source code to outsiders, or worse, competitors.
Yeah it seems pretty unlikely that any AI chat bots are manipulating code in the complex (whether the output is correct or not is immaterial to the complexity of the changes being made) ways that they are that quickly despite actually being done by humans.