What xAI's Grok Build CLI Actually Sends to xAI

Does OpenAI also have access to all github repos via partnership with microsoft?

There is a reason I run all such CLIs inside a sandbox [1] giving limited directory access.

Imagine if the CLI pulled your SSH keys or other sensitive information by mistake?

Programmers do make such mistakes all the time. I don't want to count on whether "uploading all files it can access" is intentional or a mistake.

1 - https://github.com/ashishb/amazing-sandbox

with bubblewrap it's better to pull a rootfs from dockerhub (eg. debian:unstable) then bootstrap it into a fully fledged distro rootfs living in its own folder. install the AI agents right into it, then create launch scripts that invoke bwrap with the distro rootfs (readonly) and a custom read-write /home/user and run whatever you want inside it - it will not see anything important outside the directory you give it. you can also run multiple agents each invisible to the others.

for bonus points you can uplift the bwrap container into an actual sandbox by invoking gvisor (`runsc ... do ...`) from inside it, or a virtual machine like muvm. I'm really fond of this pattern because you can trust bwrap to set up the environment, then you just need a sandbox tool to lock it down. note that bwrap by itself isn't really a sandbox, whatever is running inside it has a lot of kernel surface to attack (which can be somewhat mitigated by compiling strict seccomp filters and passing them to bwrap).

bwrap by itself will probably be sufficient against most adversaries as it would require committing to using a linux kernel 0day to escalate privs.

What's your mechanism for doing this?

Downloading the SSN/tax/etc data from the entire US wasn't bad either.

there are 2.7 m starlink subscribers in US, I don't think they are fools.

Give enough usage, you can reconstruct an entire codebase via tool calls alone, and it'll be entirely undetectable because it's all done server side. Whatever grok's doing is just more blatant, but using opencode or whatever doesn't create a meaningful security boundary. It's like the meme of using cheetos as a lock.

I agree with you, but Codex is open source.

last time I checked, codex is still open source w Apache-2.0 license

> Isn't it assumed that the AI agent is allowed to read your files in the directory you launch the harness?

Yes. There's very little story here. Maybe Grok is being like 10% more aggressive than other providers in how they assemble context (more likely: it was faster to ship this way), but any provider has the ability to do the same thing, and will happily do it if it helps improve results. Authors acknowledge this openly, but it's buried:

> "Cloud AI tools send context; this is normal." True, and conceded: any cloud coding agent must send code to its server to act on it. The novel deltas here are (a) a secrets file (e.g. .env) is transmitted unredacted, (b) the content is persisted to a named GCS bucket, not just processed transiently, and (c) the upload mechanism is not surfaced in the CLI's setup materials (§7) and on by default.

This is the entire controversial portion of the finding, in a single paragraph.

As far as the .env thing goes, you shouldn't be putting unencrypted .env files in the accessible path of any LLM. If you do, you're asking for trouble. It would obviously be better if Grok identified secrets and ignored them, but this is not a behavior you should rely on.

Even if it's uploaded once, it's still being ran through inference. It saves a bit of HTTP traffic I suppose.

Yeah this could be boiled down to maybe 2-3 paragraphs with maybe a few code blocks to show what's uploaded. This AI report is just a slog to read through and turned me off after 10s of skimming.

The icing on the cake is that users are ostensibly paying for the privilege. What a business model...

If I had no morals and was running one of these companies I would be stealmaxxing before anyone notices the scale of the grift and regulations start getting in the way.

I'm not saying they are doing this, but that's what the incentives are lined up for.

Claude reads secrets all the time. It just also tells me when secrets enter context and reminds me that they should be rotated later.

But you also have handed over your secrets, dotfiles and API keys alongside with your source code to xAI.

I'm afraid you have been scammed.

None of them upload the whole repo, which is what this link claims it does. That's unheard of.

more like it allows them to steal your trade secrets, app designs, internal business knowledge, or even just replicate whatever code/app/tool/process you had.

what was your private code, becomes their code now.

using them in VSCode all the time for months now. Qwen from Alibaba Cloud, Deepseek from deepseek.com. none of them upload entirety of codebase or even attempt to.

in fact, opposite. Chinese AI seem to post-process heaviliy locally.

they are always using head / tail, grep, sed, and do as much as they can locally and extrac meaningful data and send home (AI inference chunks). only what is really needed.

it is actually hard to force Chinese AI modesl to read full files, they really do not want to see them. even 400 lines files, is usally hit first for first line, first 50 lines. and at most 200 lines chunk reads, and give up at one or two reads.

The second I opened Deepseek, it had my harness scan my entire home dir. Not sure what's worse here.

> simplest way to disable uploading your repo is disabling it in the config

Have you verified this flag is respected?

This is completely made up. The Grok Build CLI reference lists no such thing. Whatever LLM you asked probably hallucinated this.