Grok CLI uploaded the whole home directory to GCS • Hacker News Board

Re: Grok CLI uploaded the whole home directory to GCS

#331

Post by khalic » Mon, Jul 13, 2026, 4:55 PM UTC

__MatrixMan__ wrote: post #322

khalic wrote: post #258

Earlier quoted context omitted.

And how many of those services can check your box and find permission escalation strategies on its own?

Malware has been bundling rootkits for decades, so potentially all of them. Sometimes the attacks succeed, so these are defenses that need continual hardening, but there's no sense in setting up an entirely separate line of defense just because this time the threat has AI in it.

I guess time will tell, I know I'm not giving those things any direct stdin access without a hole suite of safeguards in between

Re: Grok CLI uploaded the whole home directory to GCS

#332

Post by theplumber » Mon, Jul 13, 2026, 4:57 PM UTC

The question is why would it not? Don’t people know that these AI agents run in the cloud?

Re: Grok CLI uploaded the whole home directory to GCS

#333

Post by fnoef » Mon, Jul 13, 2026, 4:58 PM UTC

I remember a time when we were told not to run obscure software from questionable websites on our computers. And yet, people are suddenly fully vibing with an uncontrollable character generating machine with who-knows-what-behind-the-scene harness. Crazy.

Re: Grok CLI uploaded the whole home directory to GCS

#334

Post by evenhash » Mon, Jul 13, 2026, 4:58 PM UTC

drnick1 wrote: post #296

fhdkweig wrote: post #20

Earlier quoted context omitted.

That's the whole reason I refuse to install Google Drive or Dropbox's desktop applications. I only use the web interface so I know exactly what gets uploaded and when. I assume that anything running on my computer gets access to everything.

I would go further and not upload anything that isn't encrypted to cloud storage services. It is extremely likely that those "services" inspect your files.

They do, unquestionably.

https://www.thetimes.com/world/article/google-bans-father-ov...

> Mark, from San Francisco, had noticed swelling in his son’s groin and used his phone to photograph the problem to get an emergency appointment in February last year. He shared the pictures with a nurse so that a doctor could review them.

> However, Google’s artificial intelligence system used to detect child abuse flagged the image to the police and Mark, a software engineer who asked to be identified by only his first name, was investigated and lost access to his Google accounts. He was exonerated by the police in San Francisco but his Google account has not been reinstated.

Re: Grok CLI uploaded the whole home directory to GCS

#335

Post by anderber » Mon, Jul 13, 2026, 4:59 PM UTC

stronglikedan wrote: post #314

CamperBob2 wrote: post #167

Earlier quoted context omitted.

Nothing about this has anything to do with AI. It has to do with Musk's ethical and engineering standards, or the lack thereof.

[flagged]

By this standard, you should never trust a directory. Since it will push your env secrets.

Re: Grok CLI uploaded the whole home directory to GCS

#336

Post by d_silin » Mon, Jul 13, 2026, 5:00 PM UTC

chrisjj wrote: post #225

d_silin wrote: post #93

"The "S" in AI stands for security" strikes again. Run any cloud-based AI agents in VM/container and map your host's local folders to guest OS as needed. Takes more effort that default way, I know.

> Run any cloud-based AI agents in VM ... that's guaranteed vuln-free, right?

beats rawdogging it, at least.

Re: Grok CLI uploaded the whole home directory to GCS

#337

Post by loloquwowndueo » Mon, Jul 13, 2026, 5:00 PM UTC

habosa wrote: post #252

Greenpants wrote: post #127

Though I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really…

These tools are explicitly marketed as a way for non-technical people to code. If we expect those same people to understand sandboxing we're dreaming.

Leaded gasoline and tobacco were explicitly marketed as non-harmful back in the day.

Re: Grok CLI uploaded the whole home directory to GCS

#338

Post by lobo_tuerto » Mon, Jul 13, 2026, 5:00 PM UTC

zdragnar wrote: post #329

WhyNotHugo wrote: post #259

Earlier quoted context omitted.

Quick Alpine container with the current directory mounted as the current directory: docker run --rm -it -v $(pwd):/src -w /src alpine sh Replace alpine with your favourite Linux distro or image. Note entirely perfect, but will be enough against anyone not actively exploiting kernel privilege escalation bugs.

Neither podman nor docker will help you when the current directory is your home directory, though. It sounds like that's the root problem here- someone handed the keys to the kingdom to grok, and grok did what grok does, which is look at everything it can for context.

That's why I went with a different strategy and scope: Copy the current Git repo into a sandboxes dir, mount that copy in the container. The tradeoff is disk space allocated per sandbox, but I'm OK with that.

Re: Grok CLI uploaded the whole home directory to GCS

#339

Post by Havoc » Mon, Jul 13, 2026, 5:01 PM UTC

gruez wrote: post #208

simonw wrote: post #71

Important to clarify that this was not the Grok agent deciding to read the files. I don't think the LLM had anything to do with this decision at all. It looks like the Grok tool starts a session by deterministically kicking off a full upload of the user's current repository (and maybe their directory if not version tracked? Not clear if this user had previously run "git init" in their home directory) to Grok's server…

Yeah sounds like semantic indexing that cursor (pending acquisition by spacex/xAI) does. https://cursor.com/docs/agent/tools/search

They upload your ssh keys too?

Re: Grok CLI uploaded the whole home directory to GCS

#340

Post by tempodox » Mon, Jul 13, 2026, 5:02 PM UTC

Greenpants wrote: post #127

Though I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really…

Given the long history of even the most egregious data breaches with millions of affected people never having the slightest consequences, what level of care are you expecting here?