Grok Build CLI Exposed for Uploading Entire Repos and Secrets
TastyLeadership2757 · reddit · 2026-07-11
这条 Reddit 帖称，作者用 mitmproxy 抓包后发现 Grok Build CLI 会把整个仓库上传到 xAI 的云端，包含：
- 完整 git 历史；
- 你本地的 .env 等敏感文件；
- 即使提示里要求“不要读取文件”，上传依然发生。
帖子还声称：
- 被植入的一个 canary 文件，后来能从抓到的 git bundle 里被原样恢复；
- “Improve the model” 关闭后也不会阻止上传，因为那个开关只影响训练，不影响数据发送。
原帖附了复现方法、SHA-256 校验和以及 gist 证据。
Related event: xAI's Grok Build CLI Allegedly Uploads Entire Repos and Secrets(5 posts)→
More from coding & agent
- Cheaper OpenAI Agents API alternative: sandbox service undercutting E2B by 46% — airesearch12 · 2026-09-11
- His agent kill switch ran for months before he found it was wired to nothing — AnvilandCode · 2026-09-11
- Kernel's Browser Agents Can Now Pay Online Using Aliases, Never Touching Card Data — jeff_weinstein · 2026-09-11
- OpenAI opens up agent sandboxes: BYO or pick from Cloudflare, E2B, Modal, Vercel and more — threepointone · 2026-09-11
- SocialCrawl MCP lets agents search Reddit, YouTube, TikTok, X with one API key — dooddyman · 2026-09-11
- Astra builds a surprisingly polished Catan game in three.js, reusing past UI and 3D assets — FinanceYF5 · 2026-09-11