Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grok CLI uploaded the whole home directory to GCS

twitter.com

Post reply on HN
Print view View original

21–30 of 434 posts

Re: Grok CLI uploaded the whole home directory to GCS

#23

Post by steve1977 »

hoppp wrote: post #9
SurajMishra wrote: post #3

I feel this is worse than running rm -rf on a root directory. Just saying.

Much worse, instead of the data gone it's a data leak. Those ssh keys can be used to access private servers

Well, those ssh keys are protected by a strong passphrase, right?

Re: Grok CLI uploaded the whole home directory to GCS

#24

Post by docdeek »

dewey wrote: post #17
vorticalbox wrote: post #8

why do people give these LLMs full access to everything and then complain when it does somethign stupid? that is what sandboxes are for.

When I give my text editor or file browser access to everything I wouldn't expect it to exfiltrate data without asking.

Isn’t a file browser running locally, while Grok is running on someone else’s server?

Re: Grok CLI uploaded the whole home directory to GCS

#25

Post by greenavocado »

Copied this from discord:

    https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547

    Elon did this horrible thing, so I made grok build available for omp with it's own endpoint; Without sending your private repos and secret keys to them.

    -

    oh-my-pi-plugin-grok-build
    Standalone oh-my-pi extension for the xAI Grok Build subscription provider. It adds OAuth login, authoritative model discovery, and OpenAI Responses streaming with the request identity expected by Grok Build.

    Install (No-spywares):

    omp plugin install oh-my-pi-plugin-grok-build

    -

    https://github.com/metaphorics/oh-my-pi-plugin-grok-build

    Star me if you like it or if you hate spywares, lol.

Re: Grok CLI uploaded the whole home directory to GCS

#28

Post by crimsonnoodle58 »

hoppp wrote: post #9
SurajMishra wrote: post #3

I feel this is worse than running rm -rf on a root directory. Just saying.

Much worse, instead of the data gone it's a data leak. Those ssh keys can be used to access private servers

SSH keys can be limited by IP in authorized hosts.

The SSH port itself can be limited by IP in firewalls.

Finally, the SSH private key can be encrypted with a password.

Defense in depth is needed. Storing a ssh private key in plain text with no IP restriction is no different to having a password manager store your passwords in plain text on your HD.

Re: Grok CLI uploaded the whole home directory to GCS

#29

Post by master-lincoln »

inigyou wrote: post #5

https://xcancel.com/a_green_being/status/2076598897779020159 Posting a complaint about Elon on Elon's platform and tagging him is ballsy. He tends to limit visibility of accounts who do that.

ballsy only if you care about participating in that shithole of a platform.

Re: Grok CLI uploaded the whole home directory to GCS

#30

Post by ricardobeat »

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

Sandboxing is not difficult, and harnesses like Claude Code have it built-in + other protection with auto mode.
Post reply on HN