Grok CLI uploaded the whole home directory to GCS • Hacker News Board

Re: Grok CLI uploaded the whole home directory to GCS

#121

Post by grayhatter » Mon, Jul 13, 2026, 2:56 PM UTC

crimsonnoodle58 wrote: post #50

hoppp wrote: post #40

Earlier quoted context omitted.

All those things are optional. Doesn't make uploading the keys that much better. Now is the time for key rotation everywhere. Fast.

How are they optional? You obviously haven't worked anywhere security sensitive. I'm not talking about whether what Grok did is bad or good, I'm talking about protecting your private key and the servers you connect to. An unencrypted private key is no different to an unencrypted password manager, and thats a fact. Dont store secrets in plain text.

I'm a security eng and I've worked for both a FAANG and TS government contractor. Neither of them bothered with either of the of the stupid suggestions. IP restrictions prevent roaming, the point of working remotely via SSH. passwords are equally defeated by using an ssh agent, something I'd suggest everyone use. Then on top of that there's no reasonable threat model where something would be given unrestricted access to user env, but also be untrusted. If it can read from ~/.ssh neither IP protection nor keyfile password protection will protect you from maleficence.

The only reasonable response from a security perspective is don't use grok, then use it sandboxed. Trying to claim it's the users fault for not using password protection and IP restrictions is completely nonsensical. Same energy as telling someone their computer is more secure when it's off.

Re: Grok CLI uploaded the whole home directory to GCS

#122

Post by pimlottc » Mon, Jul 13, 2026, 2:56 PM UTC

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

"IMPORTANT: Before entering the leopard pen, don't forget to put on the leopard safety jacket that reads 'UNDER NOT CIRCUMSTANCES SHOULD YOU EAT MY FACE'"

Re: Grok CLI uploaded the whole home directory to GCS

#123

Post by mixedbit » Mon, Jul 13, 2026, 2:56 PM UTC

nicce wrote: post #58

lobo_tuerto wrote: post #35

The real solution to these kind of problems is sandboxing. I use podman through a bash script to launch a container whenever I want an agent to work on one of my repos. When done I just generate git patches and port back everything generated. In this way I'm not afraid of letting the agents totally lose on my computer.

Are you doing something more advanced with Podman than just mounting the files? How is the access for relevant files given? How is the authentication shared across multiple uses? Just curious to streamline the process.

I work on a sandbox which has similar isolation level to Podman (rootless Linux user namespaces), but with UX optimized for local development work. Take a look: https://github.com/wrr/drop Basically, you don't enter a separate container in which you install a new distro, but you run on top of your current distro. You have environment specific home dirs which isolate your original home, but can have some files, such as configs, mounted from your original home (mostly in read-only mode).

Re: Grok CLI uploaded the whole home directory to GCS

#124

Post by fwlr » Mon, Jul 13, 2026, 2:58 PM UTC

jesse_dot_id wrote: post #73

There are a distressing number of people in this thread who think that the agent should just be expected to do this. Yes, it is good to be paranoid, but also, the agent should never do this. Indicates horrific engineering practices at xAI.

It’s not really paranoia that makes me expect this will happen. It’s more like, well, the model weights and the files I want the model to work on have to be inside the same GPU for the agent to actually work, right? So step 1 has to be either “they send me a server rack of GPUs”, or “I send them the files I want the model to work on”. I’m not sure I could reasonably expect anything except this to happen.

Re: Grok CLI uploaded the whole home directory to GCS

#125

Post by zzril » Mon, Jul 13, 2026, 2:58 PM UTC

dewey wrote: post #54

dpoloncsak wrote: post #49

Earlier quoted context omitted.

Is it 'unexpected' when we've been hearing stories like this every week for 2 years now?

Not every Anthropic user follows HN or random X posts about these issues.

Stories about copilot messing things up made into regular newspapers...

Do Anthropic users consider themselves clever enough to not make the same mistakes as Microsoft?

Re: Grok CLI uploaded the whole home directory to GCS

#126

Post by denysvitali » Mon, Jul 13, 2026, 2:59 PM UTC

vatsanant wrote: post #110

cpt100 wrote: post #98

Why is that page not there anymore?

the post has been deleted!! So much for freedom of speech.

The post is still there: https://x.com/a_green_being/status/2076598897779020159

Not sure which weirdness happened here

Re: Grok CLI uploaded the whole home directory to GCS

#127

Post by Greenpants » Mon, Jul 13, 2026, 3:00 PM UTC

Though I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really quite unacceptable.

Re: Grok CLI uploaded the whole home directory to GCS

#128

Post by khalic » Mon, Jul 13, 2026, 3:00 PM UTC

__MatrixMan__ wrote: post #96

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I don't understand why the AI world does this. We don't need new security. We have security at home. It starts with sudo -u restricteduser myagent Your OS knows how to restrict access to things, you don't have to trust a pinkey promise from a vendor.

Why would you give a non-deterministic text generator a user account? It’s not a person, it’s barely a tool at the software level. Restrict at the right level, in this case, a complete sandbox around it given its propensity to hallucinate and be steered by anybody.

Re: Grok CLI uploaded the whole home directory to GCS

#129

Post by groundzeros2015 » Mon, Jul 13, 2026, 3:02 PM UTC

jesse_dot_id wrote: post #73

There are a distressing number of people in this thread who think that the agent should just be expected to do this. Yes, it is good to be paranoid, but also, the agent should never do this. Indicates horrific engineering practices at xAI.

What bad practices are you imagining?

Re: Grok CLI uploaded the whole home directory to GCS

#130

Post by usrusr » Mon, Jul 13, 2026, 3:02 PM UTC

ricardobeat wrote: post #30

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

Sandboxing is not difficult, and harnesses like Claude Code have it built-in + other protection with auto mode.

Is that built in protection really a filter, on code level, that sits between the LLM session and the shell or is it just some pleading in the bootstrap prompt? "Pretty please don't do xyz this is important!!!11"?

The latter can seem to be as good as the former for any amount of time. No outside observation can really prove reliability, only the negative result ("it does occasionally break the rules we expect") would be proof. So it's difficult to trust any claims that it's the former.

And even if it does have some of the former, chances are that the protection you experience is only partially provided on code level, while an unknown amount is still just bootstrap prompting that just works until does not.