Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What xAI's Grok build CLI sends to xAI: A wire-level analysis

gist.github.com

Post reply on HN
Print view View original

141–150 of 251 posts

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#141

Post by perching_aix »

phaseleza wrote: post #48

I always separate the coding tools from LLM providers, and use bubblewrap to sandbox the coding tools so they: 1. Can only read the working project directory, with .git read-only and sensitive directories hidden (mounted as empty directories). 2. Have an isolated network namespace; they can only access the internet through an HTTP proxy hosted on a Unix socket, can only access specific LLM provider hostnames, and exc…

> This makes me feel much more comfortable enabling "yolo" mode and letting the tools do everything.

But is this only a feelings thing, or did this additional hardening ever actually catch something nasty?

I find that models that do really dumb shit where constraints pay off are models not worth using in general.

Not a knock on the practice, I'm in the process of hardening my own stuff too, just curious.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#142

Post by qup »

ashishb wrote: post #79
exitb wrote: post #71

Earlier quoted context omitted.

What’s described here isn’t connected to the agentic/AI nature of the software at all. Every single program you run as a regular user could potentially do this.

And I run most of them inside sandbox now. Why would you let a markdown linter access your ssh keys?

Because I'm confident nothing will happen if it does

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#143

Post by theplumber »

faangguyindia wrote: post #111
theplumber wrote: post #83

Earlier quoted context omitted.

The AI systems ingest tons of copyrighted data and that is stealing/theft(or so we peasants were told). It’s not like they don’t know they are doing. It looks like MSFT doesnt care that much either.

How did book publishers figure out ai stole from them? Can people use a similar way to figure out if their private repos have become part of the training corpus?

Well let’s just say it’s not that hard to see that: https://variety.com/2025/digital/news/studio-ghibli-openai-s...

Note that everything GPT knows (I.e news etc) is actually from real news websites that never gave GPT rights to use their content. In the pure “American way” OpenAI closed some deals when threatened with lawsuits but of course unless you have the political connections or financials to fight trillion dollars companies stop worrying about your private repo. If it’s in the “cloud” it’s already public just not for everybody.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#144

Post by rpdillon »

taywrobel wrote: post #130
lstodd wrote: post #128

Earlier quoted context omitted.

If we lower the threshold from "absolutely" to "absent third-party breaches" what would you say?

Even with your rephrasing you’re looking for an answer in absolutes which is generally impossible, but unpacking your line of questioning, what it really amounts to is how “in the know” I am or am not. To the best of my knowledge I know about every ongoing company AI safety and user privacy initiative, and none of them involve permitting access to copilot user content to any second party or third party entity. Of cou…

Thanks for responding. It's great to hear from someone working these issues day to day, and it's the reason I come to HN. I feel like this particular line of questioning is a bit silly, with all the "Can you absolutely guarantee X, Y, and Z?" Thanks for engaging despite the adversarial turn it has taken!

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#145

Post by rpdillon »

sroerick wrote: post #19
rescbr wrote: post #14

Now, where are the people afraid of the Chinese AI companies, who claim they are going to copy their very precious code...?

The second I opened Deepseek, it had my harness scan my entire home dir. Not sure what's worse here.

I use omp with Deepseek v4 Flash and Pro. Probably put about 20 million tokens through it. I've never seen this. US-hosted versions. Opencode Zen.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#146

Post by beepbooptheory »

ashishb wrote: post #107
beepbooptheory wrote: post #51

Earlier quoted context omitted.

But in this particular case isn't the problem that it's sending everything in the sandbox? Rather than what it might do in an otherwise un-sandboxed system?

> But in this particular case isn't the problem that it's sending everything in the sandbox? If a CLI is touching certain files, they are likely to be leaked one way or the other. Why not reduce the attack surface? When does someone visit your house? Do they get unfettered access to your bedroom & safe as well?

Gotta say, if I ever was, I am really not envying the AI guys these days! Sounds terrible!

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#148

Post by jimmydoe »

Catloafdev wrote: post #52
jimmydoe wrote: post #40

Earlier quoted context omitted.

there are 2.7 m starlink subscribers in US, I don't think they are fools.

Those are people without a better option. Big difference vs xAI, where the sentiment is valid.

I'm with you, and surprised I got so many downvotes for speaking about this.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#149

Post by maleldil »

5701652400 wrote: post #78
tredre3 wrote: post #47

Earlier quoted context omitted.

> none of them upload entirety of codebase or even attempt to. How do you know? Did you do an analysis like OP did?

no analysis. only based what I see in VSCode tool calls.

I'm not saying they are, but if they were, it probably wouldn't be in explicit tool calls shown to the user.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#150

Post by taywrobel »

csande17 wrote: post #139
taywrobel wrote: post #130

Earlier quoted context omitted.

Even with your rephrasing you’re looking for an answer in absolutes which is generally impossible, but unpacking your line of questioning, what it really amounts to is how “in the know” I am or am not. To the best of my knowledge I know about every ongoing company AI safety and user privacy initiative, and none of them involve permitting access to copilot user content to any second party or third party entity. Of cou…

I think there's maybe a disconnect here that people are largely concerned with the contents of their private repos, while you're maybe more familiar with how AI interaction data is handled. (After all, the original topic of the thread was X.ai allegedly going above and beyond interaction data to exfiltrate entire repos.) I personally did get the vibe that you were being evasive, just because the things you were sayin…

That’s fair, and I appreciate the more constructively critical feedback! Also worth noting that I’m solidly on the platform service side, and the article here is largely focused on malicious client behavior.

Copilot has a lot of different clients between IDEs, agentic integrations, and GitHub apps. I don’t have awareness of the implementation details of all of them, but I can assure you that we don’t provide APIs like those mentioned in the article being used for data exfiltration.

Clients are responsible for context building, and all go through the same service that does auth, policy and quota enforcement, request routing to the underlying providers all of which have zero data retention enabled unless very specifically excluded from that (looking at you, Fable 5).

Post reply on HN