What xAI's Grok build CLI sends to xAI: A wire-level analysis

> I mount the Unix socket into the sandbox and bridge it to localhost with socat

I was experimenting with network sandboxing and found a solution that doesn't require an agent inside a sandbox. You can create listening socket on localhost inside the sandbox, send it over the Unix socket to the supervisor outside and close the Unix socket. The supervisor outside now has a listening socket that accepts connections from inside. No socat needed.

My setup was more complicated though, I wanted transparent proxying (intercepting every TCP/UDP connection without having to specify a proxy) and I spent 2 nights fighting with lack of documentation on netfilter. For TCP I ended up with creating a listening socket with IP_TRANSPARENT options and tproxy'ing all traffic into it using nftables. It was easy part. The difficult part was to figure out how to intercept UDP datagrams and send replies with correct sender address. I ended up creating IP_TRANSPARENT listening UDP socket to receive datagrams, and raw IP socket to send replies with forged source address (because single UDP socket doesn't allow sending datagrams from arbitrary port number).

ChatGPT was pretty much useless, probably due to lack of documentation and I had to experiment myself.

I still do not have the supervisor done though, that would decide whether to allow or block a connection. I have the following idea: whenever the target makes a DNS request, I reply with a new IP address like 10.x.x.x. So I can have a map which maps every IP address to a domain, and when a program connects to an IP, I can figure out which domain it is and decide whether allow or block it. This is necessary because there might be multiple IPs for a domain, they can change in time, so it is better to have a persistent mapping, to protect from DNS rebinding attacks.

> If we lower the threshold from "absolutely" to "absent third-party breaches" what would you say?

If anyone answered that question affirmatively, I'd lose a massive amount of trust in them. It would betray they fundamentally misunderstand the stochastic nature of playing defense.

The first item is "a file in the repository which contains secrets was read by the model".

Well yeah, obviously, that's pretty much intended behaviour. The LLM can't determine that there are secrets in your file before reading them.

The real issue here is that you're giving an LLM access to a file with plain-text secrets and then surprised that it reads that file.

The fact that the whole repo is automatically uploaded is crazy though, especially for multi-gigabyte repositories. This could take a long time on some connections, and seems generally pointless ­— unless there's some ulterior motive for uploading all this data.

Considering the network traffic consumption itself already very bad for Chinese users (they use VPNs)

It’s funny how you’re always policing me and not the thousands of other people that are posting much worse things. I’d be happy if there was a version where I can just see links, comments and add posts to favourites. That’s all I need really.