7 ms·
What xAI's Grok build CLI sends to xAI: A wire-level analysis
- khurs 2mo agoI imagine the terms and conditions state: -All disputes to be dealt with by arbitration -You agree to not have a trial by Jury If you go with an Elon company, you kinda have to expect ruthlessness
- beyondscaletech 2mo ago[dead]
- luciana1u 2mo ago[flagged]
- nipung 2mo ago[flagged]
- 5701652400 2mo agohaha so they just stealing entire codebases?
- cheema33 2mo agoElon doing Elon things.
- deleted 2mo ago[deleted]
- freakynit 2mo ago"It uploads the whole repository — every tracked file's content plus git history — independent of what the agent reads" Holy cow!!!! I mean I kinda expected Elon would do something like this to try to catch-up.. but this is extremely concerning. This is precisely the reason, even though their pricing is competitive and grok-4.5 is actually good enough, I chose not to go with them.
- faangguyindia 2mo agoDoes OpenAI also have access to all github repos via partnership with microsoft?
- jpollock 2mo agoIt would be _extremely_ surprising if private repos were available via that contract. Corporations wouldn't use GitHub at all if anyone other than those given direct access had read/copy permission.
- t_gamer_kle 2mo agoThey were caught stealing Apple trade secrets, dude. Nothing is beneath them.
- tyre 2mo agoNothing is beneath Altman, maybe, but Satya isn’t that dumb. MSFT cares about OAI but giving access to private data and trade secrets voluntarily would be catastrophic for them. Doesn’t feel like the type of mistake Satya would make.
- theplumber 2mo agoThe AI systems ingest tons of copyrighted data and that is stealing/theft(or so we peasants were told). It’s not like they don’t know they are doing. It looks like MSFT doesnt care that much either.
- faangguyindia 2mo agoHow did book publishers figure out ai stole from them? Can people use a similar way to figure out if their private repos have become part of the training corpus?
- 2mo ago
- jstanley 2mo agoOne reason to want to upload the entire codebase is that it allows them to have the model inspect the codebase during "thinking" without going back to the client to do real tool calls. It's not a really great reason, because what's the downside of going back to the client? But that's the best reason I can think of.
- 5701652400 2mo agomore like it allows them to steal your trade secrets, app designs, internal business knowledge, or even just replicate whatever code/app/tool/process you had. what was your private code, becomes their code now.
- jstanley 2mo agoPossibly, but people were worried about this with cloud hosting when it first came out, and it turned out to be a total nonissue.
- 5701652400 2mo agothey are literally going after "creating everything app" and "everything business" (macrohard). they are litearlly ingesting and integrating your app/business into theirs.
- SR2Z 2mo agoYeah, I'm not sure the level of trust extended to a company like Amazon or Google will also be extended to one run by Elon Musk, who is notorious for not respecting terms like this.
- avaer 2mo agoNot the same thing. Cloud hosting couldn't get away with stealing your stuff. They would lose all trust, which was far more valuable than any individual piece of content. But AI is literally all about stealing and reselling content under the protection of "AI did it" and "whoopie, we'll take a slap on the wrist". It's reasonable to assume all of the frontier companies are doing this to the maximum extent they can get away with.
- 5701652400 2mo agowill this endup in their "macrohard" (automate any business) project? will this endup in their "everything app"? guess you do not need to build "everything" yourself, when you can steal it.
- avaer 2mo agoThe icing on the cake is that users are ostensibly paying for the privilege. What a business model... If I had no morals and was running one of these companies I would be stealmaxxing before anyone notices the scale of the grift and regulations start getting in the way. I'm not saying they are doing this, but that's what the incentives are lined up for.
- 5701652400 2mo agoexactly. looks like this is what they doing
- looksjjhg 2mo ago[flagged]
- jimmydoe 2mo agothere are 2.7 m starlink subscribers in US, I don't think they are fools.
- Catloafdev 2mo agoThose are people without a better option. Big difference vs xAI, where the sentiment is valid.
- jimmydoe 2mo agoI'm with you, and surprised I got so many downvotes for speaking about this.
- looksjjhg 2mo ago[flagged]
- ahofmann 2mo agoThere is a German proverb, that goes roughly like this: "eating shit is good for you, billions of flys can't be wrong!"
- whateveracct 2mo agothat's like 1% of the US we definitely have that level of mental deficiency in this country..
- datsci_est_2015 2mo agoShades of: > People just submitted it. I don't know why. They 'trust me'. Dumb f..ks. - Zuckerberg circa 2004, in case anyone is out of the loop
- dang 2mo ago"Eschew flamebait. Avoid generic tangents." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Edit: I suppose I'd better add that this is not a defense of $THAT_GUY - just an attempted defense of HN comment quality. Edit 2: Could you please stop posting unsubstantive comments and flamebait generally? It's not what this site is for, and destroys what it is for. For example, we ban accounts that post things like https://news.ycombinator.com/item?id=48878096 https://news.ycombinator.com/item?id=48878096 and your account history unfortunately has quite a bit of this. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
- rescbr 2mo agoNow, where are the people afraid of the Chinese AI companies, who claim they are going to copy their very precious code...?
- sroerick 2mo agoThe second I opened Deepseek, it had my harness scan my entire home dir. Not sure what's worse here.
- rescbr 2mo agoWeird. I have seen it asking the harness to do `find ~ -type f | grep` to try and find my agent configuration .json file when I asked it to add a MCP server. Stupid, but they weren't sending the files back home. This was with older models though. Newer ones are a bit smarter than that.
- rpdillon 2mo agoI use omp with Deepseek v4 Flash and Pro. Probably put about 20 million tokens through it. I've never seen this. US-hosted versions. Opencode Zen.
- 5701652400 2mo agousing them in VSCode all the time for months now. Qwen from Alibaba Cloud, Deepseek from deepseek.com. none of them upload entirety of codebase or even attempt to. in fact, opposite. Chinese AI seem to post-process heaviliy locally. they are always using head / tail, grep, sed, and do as much as they can locally and extrac meaningful data and send home (AI inference chunks). only what is really needed. it is actually hard to force Chinese AI modesl to read full files, they really do not want to see them. even 400 lines files, is usally hit first for first line, first 50 lines. and at most 200 lines chunk reads, and give up at one or two reads.
- rescbr 2mo agoFor me, them allowing API usage on coding plans so we can use any harness, and returning the full unabridged reasoning back are how they earned my trust.
- charcircuit 2mo agoThe simplest way to disable uploading your repo is disabling it in the config. [harness] disable_codebase_upload=true
- culi 2mo agoThis is completely made up. The Grok Build CLI reference lists no such thing. Whatever LLM you asked probably hallucinated this.
- charcircuit 2mo ago>completely made up If you want easily verifiable evidence, run strings on the Grok Build CLI binary and you will see: Codebase upload skipped: disabled by config (harness.disable_codebase_upload=true)
- culi 2mo agoIt does not appear anywhere in the docs.
- JumpCrisscross 2mo ago> simplest way to disable uploading your repo is disabling it in the config Have you verified this flag is respected?
- charcircuit 2mo agoI verified it statically that the config value is checked and skips the upload code if it is set to true. I don't have a subscription, so it would be cool if someone could verify it statically.
- gitgud 2mo agoThis is one of the reasons why native proprietary coding agent runners like claude-code, codex, grok-build etc are so dangerous for privacy… you just don’t know what “secret sauce” they’ll add in the next update… It’s much safer to use something like opencode and use models via their API… however, the tradeoff is that it will never perform as well as it does in their native agent runners…
- gruez 2mo agoGive enough usage, you can reconstruct an entire codebase via tool calls alone, and it'll be entirely undetectable because it's all done server side. Whatever grok's doing is just more blatant, but using opencode or whatever doesn't create a meaningful security boundary. It's like the meme of using cheetos as a lock.
- rohansood15 2mo agoI agree with you, but Codex is open source.
- maxloh 2mo agoYeah. Not the Desktop App though.
- zuzululu 2mo agoits an electron app you an inspect it
- msdz 2mo agoIs the server side open-source too, as gruez brought up in the sibling comment? Technically they can still do potentially any- and everything undetected there; and for what it’s worth, even with a closed-source client bad behavior would get detected eventually through network inspection.
- jimmydoe 2mo agolast time I checked, codex is still open source w Apache-2.0 license
- jacobgold 2mo agoWith all the coding agent options, you're choosing to trust your computer, code, and business to whichever harness, model, and provider you pick. It's not a great state of affairs, but that's where we are. Choose wisely my friend.
- j_bum 2mo agoI wish a human would’ve written the overview. Nonetheless, this is disturbing.
- gruez 2mo agoYeah this could be boiled down to maybe 2-3 paragraphs with maybe a few code blocks to show what's uploaded. This AI report is just a slog to read through and turned me off after 10s of skimming.
- eternauta3k 2mo agoOr even just that a human had iterated a bit more with the LLM to improve the style.
- rvz 2mo agoBoth Grok and Claude Code are malware. This is another reason to use open source harnesses and open weight local models.
- IAmGraydon 2mo agoAnd Codex?
- trollbridge 2mo agoDescribing Claude Code as malware is kind of ridiculous. It isn’t. Neither is Grok.
- apkbobo1122 2mo ago[dead]
- culi 2mo ago> It transmits the contents of files it reads — including a .env secrets file — to xAI, verbatim and unredacted. This has to be the most successful mass surveillance campaign of all time
- hansvm 2mo agoDownloading the SSN/tax/etc data from the entire US wasn't bad either.
- lstodd 2mo agosince github. or you truly believed your code was private in private repos? I never understood that belief of a label on a button. since jira-cloud, or you truly believed your processes were private? leaks are assured, but centralisation amplifies impact. no one cares if your self-hosted something gets owned _because_ it does not affect anyone else. ...
- culi 2mo agoNeither of those examples have access to, what are basically, passwords you use for other services
- lstodd 2mo agoAt this stage passwords are irrelevant. You already moved your data out. This is all there is to it: either you control access, or you don't and then all bets are off. It is common knowledge that any ai tool will upload whatever it has access to. So why the drama? It did what it was designed to do and what you consented to by using it. If you don't want your foot sawn off learn maybe something about tool safety.
- trollbridge 2mo agoIn particularly even a harness designed not to access your secrets may still do so accidentally or be prompt-injected into doing so.
- dimgl 2mo agoGrok Build has had impressive performance in a couple of my projects. And fast. So this revelation has been very disappointing... I will say, a majority of the code I'm writing now is fully through an online LLM. If a company wanted to reconstruct a project I'm working on, they could just replay all of the tool calls from their logs, if they decide to retain the data (I did this locally once to recover a project that I mistakenly clobbered in Git). Still, this is a big overstep IMO. At the very least, they should make it clear in their terms of service and privacy policy, and not hidden through legalese. Not all usage of Grok Build will be through their enterprise plan which offers ZDR.
- rvz 2mo agoBut you also have handed over your secrets, dotfiles and API keys alongside with your source code to xAI. I'm afraid you have been scammed.
- dimgl 2mo agoA bit hyperbolic, no? A majority of code is now written through Claude and similar services.
- Catloafdev 2mo agoHow is it hyperbolic when it's literally the subject of the post? Did you not read the OP?
- dimgl 2mo agoThe "scam" part is the hyperbolic part
- hansvm 2mo agoIf I buy one thing and get a worse alternative, I usually call that a scam. $30k for a car, and it feels the need to summarize my location patterns and sell that to adtech agencies without bothering to even notify me? That's a scam. $X for a code generation tool, and it feels the need to ship all my passwords and other sensitive information to a known user-hostile entity? Also a scam. The fact that I can ~clip the antenna~ sandbox the malicious code doesn't make it not a scam; it might be a practical stopgap, but the offenders still basically got away with it.
- phaseleza 2mo agoI always separate the coding tools from LLM providers, and use bubblewrap to sandbox the coding tools so they: 1. Can only read the working project directory, with .git read-only and sensitive directories hidden (mounted as empty directories). 2. Have an isolated network namespace; they can only access the internet through an HTTP proxy hosted on a Unix socket, can only access specific LLM provider hostnames, and exclude the tool's own hostname. For example, with Crush, I will let it access *.openrouter.ai (LLM providers) but not *.charm.land (Crush's domain for auto-updating the LLM list). This makes me feel much more comfortable enabling "yolo" mode and letting the tools do everything.
- teravor 2mo agowith bubblewrap it's better to pull a rootfs from dockerhub (eg. debian:unstable) then bootstrap it into a fully fledged distro rootfs living in its own folder. install the AI agents right into it, then create launch scripts that invoke bwrap with the distro rootfs (readonly) and a custom read-write /home/user and run whatever you want inside it - it will not see anything important outside the directory you give it. you can also run multiple agents each invisible to the others. for bonus points you can uplift the bwrap container into an actual sandbox by invoking gvisor (`runsc ... do ...`) from inside it, or a virtual machine monitor like muvm. I'm really fond of this pattern because you can trust bwrap to set up the environment, then you just need a sandbox tool to lock it down. bwrap by itself will probably be sufficient against most adversaries as assuming proper config it would require committing to using a linux kernel 0day to escalate privs.
- phaseleza 2mo agoThanks for the suggestions. I've used debootstrap to build a Debian rootfs for bwrap before, but my threat model is simpler: nothing sensitive lives outside $HOME on my machine. So I just ro-bind the system dirs I need and give the sandbox a tmpfs home (one-shot apps) or a persistent fake home (stateful apps, under ~/.var/app/<appname>). This is good enough for my case. The gvisor layering looks promising though. I'll take a look and see if it would be useful.
- timr 2mo ago
- higginsniggins 2mo agoFriendly reminder: since Musk now owns Cursor, there are a bunch of really good open-source alternatives you can use.
- JumpCrisscross 2mo agoIt still somewhat blows my mind that xAI is allowed to operate in Europe given e.g. GDPR et al. Closest I can come to is Musk is above the law even in the EU given his relationship to Trump.
- supriyo-biswas 2mo agoMostly like enforcement is slow and I’m not even sure if someone has sent in a complaint.
- treexs 2mo agoTo be fair, most coding agent cli's by the labs do this and are opt in by default, it's just this does too
- edg5000 2mo agoNone of them upload the whole repo, which is what this link claims it does. That's unheard of.
- trollbridge 2mo agoCodex would like to have a chat
- drnick1 2mo agoClaude gets its own UNIX account on my dev machine. I would never trust it not to read .ssh or other sensitive private information in my home directory or elsewhere. In view of this, I should probably go further and bubblewrap it to restrict /etc, /proc and other things it legitimately does not need to do its job. I already do that for programs such as Steam (and games therein) to mitigate the possibility that they may spy on me.
- dd8601fn 2mo agoClaude reads secrets all the time. It just also tells me when secrets enter context and reminds me that they should be rotated later.
- trollbridge 2mo agoSame here. It’s possible to greek secrets, but hardly anyone ever does. Apple Intelligence does along with any PII, which makes it harder to code for.
- thejazzman 2mo agoSo xAI now has a "legal" copy of all of Tesla's code? Convenient. https://electrek.co/2026/07/10/musk-tells-tesla-staff-switch-grok/ https://electrek.co/2026/07/10/musk-tells-tesla-staff-switch...
- Geee 2mo agoIsn't it assumed that the AI agent is allowed to read your files in the directory you launch the harness? Most agents read your code on the first prompt, including any secrets you have there, which you shouldn't have. Also the .env file is for local environment, and shouldn't contain any actual secrets. AI agents should be isolated from any actual secrets, because they can't be trusted to follow instructions. If you adjust your expectations, I think it's be better to upload the code to their servers instead of sending it through context over and over again.
- deleted 2mo ago[deleted]
- edg5000 2mo agoEven if it's uploaded once, it's still being ran through inference. It saves a bit of HTTP traffic I suppose.
- timr 2mo ago> Isn't it assumed that the AI agent is allowed to read your files in the directory you launch the harness? Yes. There's very little story here. Maybe Grok is being like 10% more aggressive than other providers in how they assemble context (more likely: it was faster to ship this way), but any provider has the ability to do the same thing, and will happily do it if it helps improve results. Authors acknowledge this openly, but it's buried: > "Cloud AI tools send context; this is normal." True, and conceded: any cloud coding agent must send code to its server to act on it. The novel deltas here are (a) a secrets file (e.g. .env) is transmitted unredacted, (b) the content is persisted to a named GCS bucket, not just processed transiently, and (c) the upload mechanism is not surfaced in the CLI's setup materials (§7) and on by default. This is the entire controversial portion of the finding, in a single paragraph. As far as the .env thing goes, you shouldn't be putting unencrypted .env files in the accessible path of any LLM. If you do, you're asking for trouble. It would obviously be better if Grok identified secrets and ignored them, but this is not a behavior you should rely on.
- dminik 2mo agoIt will have to be sent through the context again. That's how LLMs work. The only reason to do this is so that Musk has clean training data for his next model. Project setup, popular libraries, CI workflows, etc.
- hippich 2mo agothis is bad... but just for chuckles, i asked grok cli to check disclosure and look through the binary and logs to see which config would stop it from doing that. no idea if it truly works, but here it is: Config after fix (~/.grok/config.toml) [harness] disable_codebase_upload = true [telemetry] trace_upload = false [features] telemetry = false
- websap 2mo agoHow do these findings compare to Codex, Claude code, and cursor
- charcircuit 2mo agoCursor is the closest as it uploads your entire source code to build a search index.
- EdwardDiego 2mo agoOh and they just shipped Grok in Cursor. Yay.
- trollbridge 2mo agoWell, it’s just yet another of 75 or so you can access from Cursor, albeit very cheaply.
- khurs 2mo agoSpaceX bought cursor, so one and same now
- goos 2mo ago> The "Improve the model" toggle makes no difference — ON or OFF, the whole repo is uploaded the same way. Oh wow that's real bad. I'm assuming most AI shops' own harnesses do something similar when you opt in for their data collection, but them doing it even if you turn it off is diabolical.
- outloudvi 2mo agoMay I put some contents against GCP's AUP in my repo, wait for Grok Build to upload them, and report the bucket to Google?
- Karmakosmik 2mo agoIsn't that expected? I always assumed the agent owns (at least) the current workspace (whatever dir it's launched in) and so can do whatever it wants in there. If they actually use this try and do things in the backend and saving prompt RTTs and tool calls that would be in my interest, no?
- dannyw 2mo agoNo, there’s the normal messages API which is what’s used to read files and deliver responses. The author has identified a second endpoint which exfils your whole project folder, into a GCP storage bucket. Anyone who designs large scale distributed systems can tell this is to scoop up training data.
- arendtio 2mo agoAFAIK, Cursor does some kind of indexing locally. So they don't have to upload all files, but can still search through them in order to find the relevant _parts_ that they upload so that the model can use them.
- jeffnash 2mo agoThis is precisely why I run a custom fork of CLIProxyAPI on a private railway server for all my agentic coding. The OG version is indispensable already and has XAI Oauth support, so you can use your subscription to call Grok from any Anthropic OR OpenAI compatible client (Claude Code, Pi, Codex, you name it). To be honest, though, I am bummed, as I do really like the grok build client. The TUI is great in the ways that matter without going out of its way to make it clear that "I'M A MID-LATE 2020s TUI LOOK AT ALL THE NOT USUAL STUFF YOU CAN DO WITH ME". Grok aside, this has become an increasingly large concern of mine, especially now that I've expanded my usual provider rotation beyond the big 2. Out of arguably reasonable paranoia, I recently bolstered my own personal CLIProxyAPI fork to use an algo similar to gitleaks/betterleaks to, on the fly, scan the incoming (i.e. from my coding agent) stream for any secrets that may have been transmitted from disk, replace them with a unique identifier, send that off to the upstream provider, and then replace the secret (mapped to that identifier in memory, encrypted and with TTL) before sending any response back. That way, if the "secret" is either not really a secret and/or truly is needed in whatever tool call or response, the replacement is seamless to the client but the provider never sees your code. No, it's not foolproof: it can't prevent some upstream actor from, say, using the on-disk key to your secret in a rogue tool call that uploads it from your device directly to an endpoint of theirs, but the low-hanging fruit like this is, IMO, the equivalent of not leaving all your windows open when you're naked. Virtually no downside or inconvenience to you, gets probably 3-4 9s of cases where someone would be inclined to see something they shouldn't because it's that easy. The alternative is literally having to approve every read request (is this even a thing now?) and spend the mental energy ensuring that each and every file could not possibly contain a secret. I'd rather just code by hand at that point.
- fareesh 2mo agosam altman: aww you're sweet elon musk: hello human resources
- rmunn 2mo agoI'd be happier if that gist had been actually written by a human. As it is, I have very little way of verifying, until someone else can confirm the findings, that the AI tool that produced that report didn't hallucinate part or all of it. It might all be accurate, for all I know, the point is that I'm having a hard time trusting an AI-generated report until it's been verified. Does anyone know if there's anyone else who has reproduced these findings for themselves yet?
- trollbridge 2mo agoI just tried it for myself and couldn’t reproduce it. However, I have no familiarity with Grok Build. Let me share my annoyance that Grok Build’s installer is yet another “curl | sh”. Please stop doing this! I assume Cursor will be replacing it soon.
- huflungdung 2mo ago[dead]
- pedromoss 2mo agoThis is exactly why tools like Landstrip[1] exist. Sandboxing is a good mitigation to an extent, but it cannot address every class of attack. If an agent allows untrusted content to influence privileged decisions, the underlying design still has a large attack surface. Claude Code is also susceptible to this class of issue because of how its plugin interface works. [1]: https://github.com/landstrip/landstrip https://github.com/landstrip/landstrip
- pedromoss 2mo agoAlso, I'm not particularly fond of using VM/microVM for sandboxing agents. This aligns with my line of thought: https://www.linkedin.com/pulse/why-your-microvm-sandbox-solves-particular-problem-very-luke-hinds-ca7pe https://www.linkedin.com/pulse/why-your-microvm-sandbox-solv...
- killix 2mo ago[flagged]
- tkamado 2mo agoHow is this not on the frontpage, this should be editorially pinned given the number of programmers here
- oxydite 2mo agoI wonder how many of you guys actually read this kind of reports (or even skim through)? At the first glance it looks to me like someone just asked an agent for a security review of this CLI and then pasted results to the gist. When I see a report like that I just assume it's a low-effort AI slop and stop reading immediately. Why would I read it since I can do the same with my agent and with that understand it better? Or if I'm really lazy then just copy paste this report and ask for a summary or have a discussion.
- IAmGraydon 2mo agoYou literally did not take 5 minutes to even start reading the report or you would have realized how ridiculous your post is.
- oxydite 2mo agoPlease tell me then how ridiculous my post is. I wanna hear that - that's why I posted this. Your comment did literally nothing useful except bumping your own ego. > You literally did not take 5 minutes to even start Yes you're exactly right - you can guess that from reading my post. But you're hitting the wrong topic there. Seems like you didn't understand what I asked. But let me elaborate on that. Why would I take >5 minutes to start reading each report I see on the web? Like all humans I have limited capacity of information I can effectively gather so I'm not gonna start reading each article 24/7. Topic was interesting, got many upvotes, so I opened the report. I saw there a bunch of LLM-generated paragraphs, got mixed feelings and just closed it. I mean just see the beginning "A measured, reproducible teardown. Findings are backed by captured artifacts (endpoint, HTTP method, status code, byte size, host) and repro commands; where an observation was seen live but not retained as a file, §7 says so explicitly.". When I see something like that I immediately lose motivation to read that.
- jessinra98 2mo ago[dead]
- IAmGraydon 2mo agoA criminal is doing criminal things. Please, let’s not act surprised. The person who runs this company is the very worst kind of human being, literally shutting down agencies to stop investigations into his business practices. I would actually be surprised if he wasn’t doing shady things to try to catch his garbage product up with the competition.
- WhyNotHugo 2mo agoThe first item is "a file in the repository which contains secrets was read by the model". Well yeah, obviously, that's pretty much intended behaviour. The LLM can't determine that there are secrets in your file before reading them. The real issue here is that you're giving an LLM access to a file with plain-text secrets and then surprised that it reads that file. The fact that the whole repo is automatically uploaded is crazy though, especially for multi-gigabyte repositories. This could take a long time on some connections, and seems generally pointless — unless there's some ulterior motive for uploading all this data.
- linzhangrun 2mo agoConsidering the network traffic consumption itself already very bad for Chinese users (they use VPNs)
- kordlessagain 2mo agoMitigation for use: ``` export GROK_TELEMETRY_TRACE_UPLOAD=0 export GROK_TELEMETRY_ENABLED=0 # or config file with [telemetry] trace_upload = false, [harness] disable_codebase_upload = true ``` The practical takeaway for users: your entire codebase leaves (uploaded) your machine unencrypted on each Grok Build invocation, not just files you ask it to read, and no visible setting stops it. I've built Nemesis8 (n8) for blast radius control and monitoring these sorts of things, from containers: https://github.com/deepbluedynamics/nemesis8 https://github.com/deepbluedynamics/nemesis8 I've added the mitigation above to the image build for Grok Build instances. There is a lot of telemetry already turned on in n8 containers, so will investigate further.
- OxO4 2mo ago[flagged]
- ben_w 2mo agoThere's many reasons to not use Musk's products, but if you wish to convince people who don't already buy into that description (or worse, who like that description), I would instead focus on the "this endangers your secrets" angle. Business secrets if you're a business, government secrets if you're a government, military secrets if you're military.
- danudey 2mo agoImagine the fallout if someone discovered a method of read access to this bucket.
- moomoo11 2mo agoimagine using grok lol it's like purposefully running into a brick wall and giving yourself a concussion. you have to be a dumbass to do it.
- cnxiaom 2mo ago[flagged]
- HNYN 2mo ago[flagged]
- Tragentics 2mo ago[flagged]
- one33seven 2mo agoRemoving the word actually from the title really confused me
- ex1fm3ta 2mo agoSo Alex Karp was right, AI companies "are stealing customers' data while charging them for unproductive tokens."
- riceball 2mo ago[flagged]
- cl0ckt0wer 2mo agoCorrect me if I'm wrong but aren't the contents of the repo sent up in the token stream eventually?
- Tiberium 2mo agoI think in this case the tool was sending the contents of the entire folder it was started in, no matter what files the LLM actually read.
- cyberge99 2mo agoAnd the .git directory contains much more information than most realize.
- patabyte 2mo agoMore or less, but most harnesses will rely on tools such as grep to only read portions of files. For even a small sized repo, only a small portion would be tokenized and uploaded
- gruez 2mo ago>For even a small sized repo, only a small portion would be tokenized and uploaded Only on a per-chat basis. Over time, it'll eventually grab the entire repo, or enough of the "secret sauce" that the rest can be reconstructed with AI.
- Stromgren 2mo agoThe things you allow the LLM to read will obviously be sent as part of a prompt. You can control that though. Reads are tool calls and you can configure permissions for that or be asked every time the agent wants to read something. This is straight up just uploading your whole working directory. Not as a LLM prompt, but to a Google Storage.
- croes 2mo ago5.1GB?
- 2mo ago
- solid_fuel 2mo agoThese things are all built on the back of stolen content, and they guy running X is a notoriously corrupt billionaire who recently ran an illegal effort to strip food and medical aid from third world countries which has already resulted in hundreds of thousands of deaths. I don’t understand why anyone would be surprised that they’re also stealing code from their users. Pay attention to what people like Musk do to those under their power. He will do the same to you in a heartbeat.
- antdke 2mo ago[flagged]
- solid_fuel 2mo agoYou should try getting your news from somewhere other than X and Fox. You know, I actually suspect musk is much worse that what has been reported, especially given his involvement with Epstein and those other creeps, but I moderated my post to only confirmed and broadly reported facts.
- croes 2mo agoHe forgot right-winger, bad father, lier (yeah sure, pedo guy is South-African slang), video game cheater, helped dismantling USAID which costs the lives of many people and the worst of all: he promoted an Uwe Boll movie
- facialwipe 2mo ago*trillionaire
- theplumber 2mo agoA lot of people are now upset because xai is running a bulk upload instead of a stream upload like oai or Anthropic. Suddenly they became aware that the AI agents are not actually running on their computers. AI agents are just uploading the shit on some servers for how long they want and in exchange of that you pay them and get some work done. I am surprised through that nobody is asking if the agents are GDRP compliant or if they are even legal considering they are trained with illegal/copyrighted content or if you are liable for theft because now you own, publish and sell illegal content generated by agents…. Enough ranting…instead of this stuff people should just admit that after social media, AI is the new frontier towards a kind of zero privacy, at least until you can have local AI/if ever.
- Stromgren 2mo agoThere’s a hell of a difference between a tool that asks my permission to read a file to make it part of a prompt and a tool that packages up my whole working directory and sends it to Google Cloud Storage.
- janalsncm 2mo agoDepending on how many files it requests to read, in practice there might not be a difference at all.
- Stromgren 2mo agoOf course there is. It’s not about the _amount_ of files or how many percent of them. I might have 1000 files that I’m fine having the LLM read and then some that it really shouldn’t. The problem here is plainly uploading your whole directory without prompting for permissions to read them - even if you explicitly set up permissions for read tools.
- the8472 2mo ago> even if you explicitly set up permissions for read tools. Part of problem is that "permissions" here are managed by the tools themselves as if filesystem access control hasn't been invented yet. Even a half-assed sandbox container would be better than that.
- Cider9986 2mo agoI assume this doesn't have anything to do with their speed improvements. Grok 4.5 is so fast, it's great. And only $10/month subscription. It's slightly less censored as well.
- inigyou 2mo agoI tried to use Grok once, but it required a Twitter Blue subscription, which required a 30-day-old Twitter account and for some reason they kept flagging my account for fraud sooner than that. Are they still doing these requirements?
- janalsncm 2mo agoIf this doesn’t bother you (depending on the codebase it might not) you should know Deepseek flash is free on opencode, probably because they’re doing something similar. If it does, I’m not sure what to recommend. Even Anthropic and OpenAI might be training on your code anyways. See: Alex Karp.
- rvz 2mo agoThis is yet another reason to use open weight models and open source harnesses so that this can never happen. Why do you continue to give these companies all your secrets, env vars, source code and data? That is effectively a data breach by this form of malware. If you had data that was never meant to be uploaded or shared by a third party, consider that a security incident.
- inigyou 2mo agoIt turns out that utility overrides all security concerns. It's the same reason that Cloudflare gets to snoop on 90% of web traffic. If you wanted a honeypot you couldn't ask for a better one.
- VortexLain 2mo agoAfter this, I reconsider whether I want to use grok 4.5 just over an API at all.
- slowmovintarget 2mo agoWhy use this CLI over something like OpenCode?
- kwar13 2mo agoThe only way is to make sure your AI cannot possibly read what it's not supposed to. For CC, I have a bubblewrap that has been effective: https://kaveh.page/blog/claude-code-sandbox https://kaveh.page/blog/claude-code-sandbox
- I_am_tiberius 2mo agoDon't trust x companies!!!