Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What xAI's Grok build CLI sends to xAI: A wire-level analysis

gist.github.com

Post reply on HN
Print view View original

11–20 of 251 posts

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#11

Post by SR2Z »

jstanley wrote: post #7
5701652400 wrote: post #6

Earlier quoted context omitted.

more like it allows them to steal your trade secrets, app designs, internal business knowledge, or even just replicate whatever code/app/tool/process you had. what was your private code, becomes their code now.

Possibly, but people were worried about this with cloud hosting when it first came out, and it turned out to be a total nonissue.

Yeah, I'm not sure the level of trust extended to a company like Amazon or Google will also be extended to one run by Elon Musk, who is notorious for not respecting terms like this.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#12

Post by faangguyindia »

freakynit wrote: post #4

"It uploads the whole repository — every tracked file's content plus git history — independent of what the agent reads" Holy cow!!!! I mean I kinda expected Elon would do something like this to try to catch-up.. but this is extremely concerning. This is precisely the reason, even though their pricing is competitive and grok-4.5 is actually good enough, I chose not to go with them.

Does OpenAI also have access to all github repos via partnership with microsoft?

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#13

Post by avaer »

jstanley wrote: post #7
5701652400 wrote: post #6

Earlier quoted context omitted.

more like it allows them to steal your trade secrets, app designs, internal business knowledge, or even just replicate whatever code/app/tool/process you had. what was your private code, becomes their code now.

Possibly, but people were worried about this with cloud hosting when it first came out, and it turned out to be a total nonissue.

Not the same thing. Cloud hosting couldn't get away with stealing your stuff. They would lose all trust, which was far more valuable than any individual piece of content.

But AI is literally all about stealing and reselling content under the protection of "AI did it" and "whoopie, we'll take a slap on the wrist". It's reasonable to assume all of the frontier companies are doing this to the maximum extent they can get away with.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#15

Post by Gagarin1917 »

5701652400 wrote: post #6
jstanley wrote: post #5

One reason to want to upload the entire codebase is that it allows them to have the model inspect the codebase during "thinking" without going back to the client to do real tool calls. It's not a really great reason, because what's the downside of going back to the client? But that's the best reason I can think of.

more like it allows them to steal your trade secrets, app designs, internal business knowledge, or even just replicate whatever code/app/tool/process you had. what was your private code, becomes their code now.

If you’re worried about this why are you using a third party AI in the first place?

Running any query in Claude or Codex could result in the AI reading/uploading any file in your codebase.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#16

Post by faangguyindia »

5701652400 wrote: post #6
jstanley wrote: post #5

One reason to want to upload the entire codebase is that it allows them to have the model inspect the codebase during "thinking" without going back to the client to do real tool calls. It's not a really great reason, because what's the downside of going back to the client? But that's the best reason I can think of.

more like it allows them to steal your trade secrets, app designs, internal business knowledge, or even just replicate whatever code/app/tool/process you had. what was your private code, becomes their code now.

Your trade secret is already gone the moment you unleashed non local ai agents on your codebase.

This is why I keep a separate repo for important parts that I do not want competitors to get access to, and only use ai on dumb parts which I don't care if get leaked tomorrow.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#17

Post by jpollock »

faangguyindia wrote: post #12
freakynit wrote: post #4

"It uploads the whole repository — every tracked file's content plus git history — independent of what the agent reads" Holy cow!!!! I mean I kinda expected Elon would do something like this to try to catch-up.. but this is extremely concerning. This is precisely the reason, even though their pricing is competitive and grok-4.5 is actually good enough, I chose not to go with them.

Does OpenAI also have access to all github repos via partnership with microsoft?

It would be _extremely_ surprising if private repos were available via that contract. Corporations wouldn't use GitHub at all if anyone other than those given direct access had read/copy permission.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#18

Post by 5701652400 »

Gagarin1917 wrote: post #15
5701652400 wrote: post #6

Earlier quoted context omitted.

more like it allows them to steal your trade secrets, app designs, internal business knowledge, or even just replicate whatever code/app/tool/process you had. what was your private code, becomes their code now.

If you’re worried about this why are you using a third party AI in the first place? Running any query in Claude or Codex could result in the AI reading/uploading any file in your codebase.

key point: Grok is not even using the files they upload.

they send home entirety of codebase that they do not even use for user AI queries.

and why use cloud AI for coding? how is this even a question in 2026? if you don't, you can't compete with somone who does use it.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#20

Post by avaer »

5701652400 wrote: post #8

will this endup in their "macrohard" (automate any business) project? will this endup in their "everything app"? guess you do not need to build "everything" yourself, when you can steal it.

The icing on the cake is that users are ostensibly paying for the privilege. What a business model...

If I had no morals and was running one of these companies I would be stealmaxxing before anyone notices the scale of the grift and regulations start getting in the way.

I'm not saying they are doing this, but that's what the incentives are lined up for.

Post reply on HN