Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What xAI's Grok build CLI sends to xAI: A wire-level analysis

gist.github.com

Post reply on HN
Print view View original

51–60 of 251 posts

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#51

Post by beepbooptheory »

ashishb wrote: post #46
freakynit wrote: post #4

"It uploads the whole repository — every tracked file's content plus git history — independent of what the agent reads" Holy cow!!!! I mean I kinda expected Elon would do something like this to try to catch-up.. but this is extremely concerning. This is precisely the reason, even though their pricing is competitive and grok-4.5 is actually good enough, I chose not to go with them.

There is a reason I run all such CLIs inside a sandbox [1] giving limited directory access. Imagine if the CLI pulled your SSH keys or other sensitive information by mistake? Programmers do make such mistakes all the time. I don't want to count on whether "uploading all files it can access" is intentional or a mistake. 1 - https://github.com/ashishb/amazing-sandbox

But in this particular case isn't the problem that it's sending everything in the sandbox? Rather than what it might do in an otherwise un-sandboxed system?

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#53

Post by Catloafdev »

dimgl wrote: post #45
rvz wrote: post #42

Earlier quoted context omitted.

But you also have handed over your secrets, dotfiles and API keys alongside with your source code to xAI. I'm afraid you have been scammed.

A bit hyperbolic, no? A majority of code is now written through Claude and similar services.

How is it hyperbolic when it's literally the subject of the post? Did you not read the OP?

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#55

Post by dimgl »

Catloafdev wrote: post #53
dimgl wrote: post #45

Earlier quoted context omitted.

A bit hyperbolic, no? A majority of code is now written through Claude and similar services.

How is it hyperbolic when it's literally the subject of the post? Did you not read the OP?

The "scam" part is the hyperbolic part

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#56

Post by JumpCrisscross »

charcircuit wrote: post #22

The simplest way to disable uploading your repo is disabling it in the config. [harness] disable_codebase_upload=true

> simplest way to disable uploading your repo is disabling it in the config

Have you verified this flag is respected?

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#57

Post by processunknown »

jpollock wrote: post #17
faangguyindia wrote: post #12

Earlier quoted context omitted.

Does OpenAI also have access to all github repos via partnership with microsoft?

It would be _extremely_ surprising if private repos were available via that contract. Corporations wouldn't use GitHub at all if anyone other than those given direct access had read/copy permission.

It wouldnt be _that_ surprising since they committed widespread copyright violations building the models, plus the recent Apple IP theft...

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#60

Post by drnick1 »

Claude gets its own UNIX account on my dev machine. I would never trust it not to read .ssh or other sensitive private information in my home directory or elsewhere.

In view of this, I should probably go further and bubblewrap it to restrict /etc, /proc and other things it legitimately does not need to do its job. I already do that for programs such as Steam (and games therein) to mitigate the possibility that they may spy on me.

Post reply on HN