Grok Build CLI Exposed for Uploading Entire Repos and Secrets
TastyLeadership2757 · reddit · 2026-07-11
这条 Reddit 帖称，作者用 mitmproxy 抓包后发现 Grok Build CLI 会把整个仓库上传到 xAI 的云端，包含：
- 完整 git 历史；
- 你本地的 .env 等敏感文件；
- 即使提示里要求“不要读取文件”，上传依然发生。
帖子还声称：
- 被植入的一个 canary 文件，后来能从抓到的 git bundle 里被原样恢复；
- “Improve the model” 关闭后也不会阻止上传，因为那个开关只影响训练，不影响数据发送。
原帖附了复现方法、SHA-256 校验和以及 gist 证据。
Related event: xAI's Grok Build CLI Allegedly Uploads Entire Repos and Secrets(5 posts)→
More from coding & agent
- Sol61 flunks instruction-following: skips mandated research even when explicitly told — lucasmeijer · 2026-10-26
- Ben Bajarin: Frontier AI is becoming the enterprise cyber-defense stack — BenBajarin · 2026-10-26
- Building AI bots on raw APIs? Devs say models are 'dumb without the harness' — madeofAjala · 2026-10-26
- HarnessMM cuts agent tokens per task by up to 88% while raising success rates — omarsar0 · 2026-10-26
- Microsoft demos intent-classifying agents built with Copilot App and Foundry, deployable across Teams and Outlook — marlene_zw · 2026-10-26
- Looking for a wearable mic with best battery life that feeds recordings to personal agents via MCP — altryne · 2026-10-26