xAI 的 Grok Build CLI 工具被发现会上传整个 Git 代码库，包括完整的提交历史和 .env 密钥等敏感文件，至 xAI 的 Google Cloud Storage。研究人员捕获了这一行为，表明该工具会发送所有跟踪的文件，而不管任务是什么或是否有明确指示不访问某些数据。即使在用户选择退出模型改进的情况下，上传功能仍然存在，这引发了重大的隐私和安全担忧。 AI
影响 引发了使用 AI 工具的开发者的重大隐私和安全担忧，可能影响对 AI 驱动的开发工具的信任和采用。
排序理由 该集群报告了与特定工具功能相关的安全漏洞和隐私问题，而不是新的模型发布或公司范围内的重大事件。
在 Mastodon — fosstodon.org 阅读 →
AI 生成摘要 · Google Gemini · 来自 5 个来源。 我们如何撰写摘要 →
🤖 xAI's Grok Build CLI tool uploads entire Git repositories (full commit history) to xAI's Google Cloud Storage — not just files needed for a task. A researcher captured an upload, cloned the git bundle, and retrieved a file the agent was explicitly told not to access. 🔗 https://…
«Reproduce it yourself: show that # xAI 's # Grok Build CLI uploads your entire repository — every tracked file plus full git history — to xAI's cloud (POST /v1/storage, routed to the GCS bucket grok-code-session-traces), independent of what the agent reads, and that turning off …
Grok Build CLI exposed for uploading entire repos including .env secrets, GPU financing faces circular debt concerns, and the anti-AI Ghost Font was decoded by GPT-4 in minutes. https:// ai0.news/posts/2026-07-12-dail y-digest/ # AI # Cybersecurity # LocalLLM # OpenSource
<!-- SC_OFF --><div class="md"><p>I ran Grok Build CLI (v0.2.93) through mitmproxy. It uploads your <strong>entire repo as a git bundle (full history)</strong> to xAI's Google Cloud — independent of what you open. With the prompt literally <em>"do not read or open any files,…
Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured) https://www. reddit.com/r/LocalLLaMA/commen ts/1ut7tis/grok_build_cli_uploads_your_whole_repo_full_git/ Grok is committing full on theft, by …