Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What xAI's Grok build CLI sends to xAI: A wire-level analysis

gist.github.com

Post reply on HN
Print view View original

221–230 of 251 posts

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#221

Post by croes »

antdke wrote: post #215
solid_fuel wrote: post #211

These things are all built on the back of stolen content, and they guy running X is a notoriously corrupt billionaire who recently ran an illegal effort to strip food and medical aid from third world countries which has already resulted in hundreds of thousands of deaths. I don’t understand why anyone would be surprised that they’re also stealing code from their users. Pay attention to what people like Musk do to tho…

[flagged]

He forgot right-winger, bad father, lier (yeah sure, pedo guy is South-African slang), video game cheater, helped dismantling USAID which costs the lives of many people and the worst of all: he promoted an Uwe Boll movie

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#222

Post by Stromgren »

theplumber wrote: post #214

A lot of people are now upset because xai is running a bulk upload instead of a stream upload like oai or Anthropic. Suddenly they became aware that the AI agents are not actually running on their computers. AI agents are just uploading the shit on some servers for how long they want and in exchange of that you pay them and get some work done. I am surprised through that nobody is asking if the agents are GDRP compli…

There’s a hell of a difference between a tool that asks my permission to read a file to make it part of a prompt and a tool that packages up my whole working directory and sends it to Google Cloud Storage.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#224

Post by janalsncm »

If this doesn’t bother you (depending on the codebase it might not) you should know Deepseek flash is free on opencode, probably because they’re doing something similar.

If it does, I’m not sure what to recommend. Even Anthropic and OpenAI might be training on your code anyways. See: Alex Karp.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#225

Post by rvz »

This is yet another reason to use open weight models and open source harnesses so that this can never happen.

Why do you continue to give these companies all your secrets, env vars, source code and data? That is effectively a data breach by this form of malware.

If you had data that was never meant to be uploaded or shared by a third party, consider that a security incident.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#226

Post by inigyou »

Cider9986 wrote: post #223

I assume this doesn't have anything to do with their speed improvements. Grok 4.5 is so fast, it's great. And only $10/month subscription. It's slightly less censored as well.

I tried to use Grok once, but it required a Twitter Blue subscription, which required a 30-day-old Twitter account and for some reason they kept flagging my account for fraud sooner than that. Are they still doing these requirements?

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#227

Post by janalsncm »

Stromgren wrote: post #222
theplumber wrote: post #214

A lot of people are now upset because xai is running a bulk upload instead of a stream upload like oai or Anthropic. Suddenly they became aware that the AI agents are not actually running on their computers. AI agents are just uploading the shit on some servers for how long they want and in exchange of that you pay them and get some work done. I am surprised through that nobody is asking if the agents are GDRP compli…

There’s a hell of a difference between a tool that asks my permission to read a file to make it part of a prompt and a tool that packages up my whole working directory and sends it to Google Cloud Storage.

Depending on how many files it requests to read, in practice there might not be a difference at all.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#228

Post by inigyou »

rvz wrote: post #225

This is yet another reason to use open weight models and open source harnesses so that this can never happen. Why do you continue to give these companies all your secrets, env vars, source code and data? That is effectively a data breach by this form of malware. If you had data that was never meant to be uploaded or shared by a third party, consider that a security incident.

It turns out that utility overrides all security concerns. It's the same reason that Cloudflare gets to snoop on 90% of web traffic. If you wanted a honeypot you couldn't ask for a better one.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#229

Post by Stromgren »

janalsncm wrote: post #227
Stromgren wrote: post #222

Earlier quoted context omitted.

There’s a hell of a difference between a tool that asks my permission to read a file to make it part of a prompt and a tool that packages up my whole working directory and sends it to Google Cloud Storage.

Depending on how many files it requests to read, in practice there might not be a difference at all.

Of course there is. It’s not about the _amount_ of files or how many percent of them. I might have 1000 files that I’m fine having the LLM read and then some that it really shouldn’t. The problem here is plainly uploading your whole directory without prompting for permissions to read them - even if you explicitly set up permissions for read tools.

Re: What xAI's Grok build CLI sends to xAI: A wire-level analysis

#230

Post by the8472 »

Stromgren wrote: post #229
janalsncm wrote: post #227

Earlier quoted context omitted.

Depending on how many files it requests to read, in practice there might not be a difference at all.

Of course there is. It’s not about the _amount_ of files or how many percent of them. I might have 1000 files that I’m fine having the LLM read and then some that it really shouldn’t. The problem here is plainly uploading your whole directory without prompting for permissions to read them - even if you explicitly set up permissions for read tools.

> even if you explicitly set up permissions for read tools.

Part of problem is that "permissions" here are managed by the tools themselves as if filesystem access control hasn't been invented yet. Even a half-assed sandbox container would be better than that.

Post reply on HN