Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What xAI's Grok build CLI sends to xAI: A wire-level analysis

gist.github.com

Post reply on HN
Print view View original

111–120 of 251 posts

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#111

Post by faangguyindia »

theplumber wrote: post #83
tyre wrote: post #44

Earlier quoted context omitted.

Nothing is beneath Altman, maybe, but Satya isn’t that dumb. MSFT cares about OAI but giving access to private data and trade secrets voluntarily would be catastrophic for them. Doesn’t feel like the type of mistake Satya would make.

The AI systems ingest tons of copyrighted data and that is stealing/theft(or so we peasants were told). It’s not like they don’t know they are doing. It looks like MSFT doesnt care that much either.

How did book publishers figure out ai stole from them? Can people use a similar way to figure out if their private repos have become part of the training corpus?

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#112

Post by lstodd »

taywrobel wrote: post #87
anonymousiam wrote: post #84

Earlier quoted context omitted.

How do you define "access" here? Microsoft has demonstrated that it can delete any GitHub repo at will. Maybe there's some shell entity between corporate "Microsoft" and "GitHub" that's doing the dirty deeds without attribution...

Access meaning read, modify, delete, etc. Pretty standard definition, unless you know of a different meaning of access I’m not privy to. Microsoft can certainly request that we perform actions against repositories, as can governments, customers, random people on the street, etc. Whether action is taken in those cases is a question for lawyers to fight over, but we have the engineering guardrails in place to require i…

Can you state with absolute сertainity that no entity outside your github unit can exfiltrate data at will?

This is not spicy, this is basic infosec.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#113

Post by rmunn »

I'd be happier if that gist had been actually written by a human. As it is, I have very little way of verifying, until someone else can confirm the findings, that the AI tool that produced that report didn't hallucinate part or all of it. It might all be accurate, for all I know, the point is that I'm having a hard time trusting an AI-generated report until it's been verified.

Does anyone know if there's anyone else who has reproduced these findings for themselves yet?

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#114

Post by whateveracct »

freakynit wrote: post #4

"It uploads the whole repository — every tracked file's content plus git history — independent of what the agent reads" Holy cow!!!! I mean I kinda expected Elon would do something like this to try to catch-up.. but this is extremely concerning. This is precisely the reason, even though their pricing is competitive and grok-4.5 is actually good enough, I chose not to go with them.

it's straight up data exfiltration and should be illegal

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#115

Post by csande17 »

taywrobel wrote: post #65
faangguyindia wrote: post #12

Earlier quoted context omitted.

Does OpenAI also have access to all github repos via partnership with microsoft?

GitHub Copilot engineer here working on identity, safety, and privacy - no, even Microsoft doesn’t have access to all GitHub repos. As years have passed since the acquisition “company” delineations have blurred a bit, but Microsoft employees still need to go through a separate onboarding process to access any GitHub company resources (internal repositories, telemetry, documentation, etc.), and then we have an additio…

This is a nice answer to the question "how is GitHub preventing rogue employees at Microsoft from stealing my private repositories?". Like, it's good to know I'm covered if Microsoft accidentally hires a North Korean spy or something.

But if Microsoft really was selling private repo content to OpenAI, it probably wouldn't go through those access controls. It'd be an executive-level decision with enough force to plow through all the red tape, and it'd be implemented as a data pipeline or similar automated process that wouldn't trigger the same kind of notification as, like, a Trust and Safety employee taking manual action.

Probably the better evidence here is in GitHub's ToS where they say in pretty strong/binding terms that they aren't doing this: https://docs.github.com/en/site-policy/github-terms/github-t... . If they are secretly selling your data to OpenAI they haven't left themselves a ton of wiggle room if people ever found out.

(Probably the biggest loophole they could use is to send private repo content to an OpenAI service for scanning/safety purposes. The ToS allows this and they're almost certainly doing it with other services like PhotoDNA. Then OpenAI can just violate whatever agreement they have not to store the data sent to that service.)

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#117

Post by taywrobel »

lstodd wrote: post #112
taywrobel wrote: post #87

Earlier quoted context omitted.

Access meaning read, modify, delete, etc. Pretty standard definition, unless you know of a different meaning of access I’m not privy to. Microsoft can certainly request that we perform actions against repositories, as can governments, customers, random people on the street, etc. Whether action is taken in those cases is a question for lawyers to fight over, but we have the engineering guardrails in place to require i…

Can you state with absolute сertainity that no entity outside your github unit can exfiltrate data at will? This is not spicy, this is basic infosec.

Nobody can say that with absolute certainty, so obviously not.

And since you presumably knew that already (as it is basic infosec) then yes it is spicy, or simply antagonistic.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#118

Post by faangguyindia »

MattGaiser wrote: post #108
processunknown wrote: post #57

Earlier quoted context omitted.

It wouldnt be _that_ surprising since they committed widespread copyright violations building the models, plus the recent Apple IP theft...

This speaks to OpenAI's approach to things. But it doesn't speak to Microsoft and Microsoft would need to provide the access.

this might be relevant about microsoft.

Federal Cyber Experts Thought Microsoft’s Cloud Was “a Pile of Shit.” They Approved It Anyway:

https://www.propublica.org/article/microsoft-cloud-fedramp-c...

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#119

Post by lstodd »

culi wrote: post #34

> It transmits the contents of files it reads — including a .env secrets file — to xAI, verbatim and unredacted. This has to be the most successful mass surveillance campaign of all time

since github. or you truly believed your code was private in private repos? I never understood that belief of a label on a button.

since jira-cloud, or you truly believed your processes were private?

leaks are assured, but centralisation amplifies impact. no one cares if your self-hosted something gets owned _because_ it does not affect anyone else.

...

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#120

Post by maronato »

jstanley wrote: post #5

One reason to want to upload the entire codebase is that it allows them to have the model inspect the codebase during "thinking" without going back to the client to do real tool calls. It's not a really great reason, because what's the downside of going back to the client? But that's the best reason I can think of.

I think it’s so people can “remote control” from their phones even if their computer is offline, via a container somewhere. Then they can get back to local dev, syncing the changes from their GCP bucket. Seems reasonably useful to me - not give-Elon-my-entire-repo useful, but useful. The fact that they made it something you can’t opt out of and wasn’t disclosed at all really reinforces that they shouldn’t be trusted with it.
Post reply on HN