I don't think they do at the moment, but they could be trained subtly add backdoors to code or make "phone home" api calls during dev time, triggering on certain conditions ("is user employee of xyz")