7 ms·

> exfiltrating user data (including env files, entire source code etc) which is what grok-build did here I think env files are filtered out [1]. Anyway, the mo

> exfiltrating user data (including env files, entire source code etc) which is what grok-build did here I think env files are filtered out [1]. Anyway, the most suspicious code would be `upload_session_state` which is currently a stub function, though it is hard to say if it was only planned (badly) or has been removed as a damage control. [1] https://github.com/xai-org/grok-build/blob/c1b5909ec707c069f1d21a93917af044e71da0d7/crates/codegen/xai-file-utils/src/upload_config.rs#L49-L81 https://github.com/xai-org/grok-build/blob/c1b5909ec707c069f...

stefan_ 2mo ago
No, those are directory names not uploaded. Here are the file names skipped: https://github.com/xai-org/grok-build/blob/main/crates/codegen/xai-file-utils/src/upload_config.rs#L91C11-L91C29 https://github.com/xai-org/grok-build/blob/main/crates/codeg... It's about not uploading compiled binary stuff, but they want all your environment data all the same.
threecheese 2mo ago
It must have been removed, given that the initial evidence of the exfil specifically demonstrated .env files being included. And .ssh/* for the user which ran this in $HOME.