Grok Uploads Plaintext Secrets When Reading Files
WesEklund · x · 2026-07-14
Wes Eklund observed that when grok reads files to answer questions or review code, the contents enter the LLM context sent to the responses endpoint in plaintext.
Implications listed include:
- Real secrets in .env files will be sent to xAI servers
- Credentials in config files are fully transmitted
- No local filtering of sensitive content occurs before sending
- No warnings are provided when suspected secret files are detected
The core message is a warning: cloud-based LLMs/code assistants reading local files pose a clear risk of leaking secrets and compromising privacy.
More from coding & agent
- He benchmarks new models by having them build their own copilot — $28 of compute — bucolucas · 2026-10-27
- Founder generates 46 app promo videos in 4 days with Claude, skipping $11,500 in UGC fees — PrajwalTomar_ · 2026-10-27
- Should agents be allowed to change plans mid-task? Reddit debates the drift boundary — wistfulcracker84 · 2026-10-27
- HeyGen + Canva MCP turns slide speaker notes into an avatar presentation video — HeyGen · 2026-10-27
- Local beats cloud: Qwen 3.8 FN handles private student data as well as frontier models — dr_lm · 2026-10-27
- Cloudflare Computer adds agent interruption recovery and approval pauses in v0.7.0 — irvinebroque · 2026-10-27