Though I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really quite unacceptable.
Not to mention the very wide push to "Use AI NOW, for EVERYTHING!" in marketing ans many companies, with hardly any though given to safety or where does all the data end up.
My first thought would be their server side extentions, code excecutoon sandboxes and document RAG search, being on by default? Probably should be an opt-in instead of an opt-out.
This wasn't the LLM, it was Grok CLI preemptively uploading the entire CWD, regardless of where that CWD is, to its own server.
I don't think it is reasonable to expect every user (including those just starting out with the tools - maybe experimenting, maybe younger/less experienced in general) to think that the tool they're running for the very first time is going to automatically exfiltrate all of their data.
It's a pretty serious fuck-up. This guy tweeted about it, who knows how many didn't even notice. It should have been opt-in, it should give user an indication that it's about to do this, etc.
I think there are arguments on both sides. People should look for guidance on how to use complex tools, but we know people will not.
Whose fault is it if someone drives a car without learning how to and injures themselves? On the other hand if the manufacturer has promoted it as one you can drive without learning how to, then whose fault is it?
A lot of users are fine with everything being uploaded. Most people's primary computing device is now a phone that backs up everything to cloud and using apps that are thin front ends over cloud services.
The grok-cli is on github[0] there is nothing that I can see in the code that is activily looping ~/ and uploading everything.
My two guesses would be one the LLM decided it needed these files for the task or two the user simple asked grok to do it so they could post the tool calls on twitter.
That is not the Grok CLI being discussed. That's an open source, third party CLI. https://x.ai/cli is the official Grok CLI being discussed, and it is not open source.
If your immediate reaction to a new piece of software siphoning up someone’s entire system full of highly personal data is, “you’re holding it wrong”, it might help to take a beat and remember that software was developed by a multi-trillion dollar company’s entire business model revolves around siphoning up as much highly personal data as possible
The point is more that you should not blame the user (why didn't you set up sandbox instead of directly using the tool of big corp) if a tool does something unexpected. If your Dropbox client would suddenly just upload your home directory instead of it's folder you configured you'd also not blame the user that they use Dropbox, you'd blame Dropbox for not doing their job correctly or being user hostile.
Agreed. You can still encourage people to use defense in depth without actively blaming them for not having the deepest moat imaginable. Software creators still have some responsibility
But Claude Code, arguably one of the most famous ones, is not. And recently got some heat about sending meta data that wasn't so obvious. Just as a counter-example.
Is the Grok CLI a 2 terabyte install? Did Elon dropship you an 8U rack of B200s?
No?
Well the model weights, the GPUs, and the context obviously all have to be in the same place, so “sending your project to them” is literally the only thing that could possibly happen, unless you think agents work by fucking magic.
This is the biggest case of PEBKAC in history, maybe ever.
This is the kind of confusion that Charles Babbage could not rightly comprehend, except at those politicians at least had the excuse that computers had only been invented five minutes prior.
If you decide that your entire home directory is the project, as the OP did by setting the repo_path to ~/, then, well… I mean, if you ask me, I don’t recommend it, but it’s your computer and your free will.
It's fascinating how many people in this conversation think that LLMs need to have all of the files in your $CWD on the model provider's servers to be able to do anything.
https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547
Elon did this horrible thing, so I made grok build available for omp with it's own endpoint; Without sending your private repos and secret keys to them.
-
oh-my-pi-plugin-grok-build
Standalone oh-my-pi extension for the xAI Grok Build subscription provider. It adds OAuth login, authoritative model discovery, and OpenAI Responses streaming with the request identity expected by Grok Build.
Install (No-spywares):
omp plugin install oh-my-pi-plugin-grok-build
-
https://github.com/metaphorics/oh-my-pi-plugin-grok-build
Star me if you like it or if you hate spywares, lol.
Fully agentic development (supervised)
So is X going to claim the user disabled something the second before everything went south? That's what the owner's other company does.
I am genuinely fascinated by this.
I don’t like piling on especially with security vulnerabilities, but man how many red flags do you need to ignore?
They won’t stop abusing us until we stop using their products.
> They won’t stop abusing us until we stop using their products.
I don't use AI at all in my daily life.
Work however will demand you use it.
AI is not here to help people.
Nothing about this has anything to do with AI. It has to do with Musk's ethical and engineering standards, or the lack thereof.
I think my first clue was when their CEO hired a bunch of teenage hackers to sack the government and exfiltrate all our data.
I didn't really need a second clue.
Most people don’t know about that because they live in an information bubble handcrafted by the oligarchs.
It's not a subtle pattern.
This is particularly the whole reason why I created https://github.com/VibePod/vibepod-cli
If someone wants to contribute the Grok CLI I'm happy to support it.
Though I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really quite unacceptable.
We should also be mindful of how much these tools break down the "be careful and thoughtful" barriers in favor of more and more convenience.
Not to mention the very wide push to "Use AI NOW, for EVERYTHING!" in marketing ans many companies, with hardly any though given to safety or where does all the data end up.
Well, it looks like he was running the agent in his home directory to begin with considering the `repo_path` field is exactly that.
My first thought would be their server side extentions, code excecutoon sandboxes and document RAG search, being on by default? Probably should be an opt-in instead of an opt-out.
why do people give these LLMs full access to everything and then complain when it does somethign stupid? that is what sandboxes are for.
This wasn't the LLM, it was Grok CLI preemptively uploading the entire CWD, regardless of where that CWD is, to its own server.
I don't think it is reasonable to expect every user (including those just starting out with the tools - maybe experimenting, maybe younger/less experienced in general) to think that the tool they're running for the very first time is going to automatically exfiltrate all of their data.
It's a pretty serious fuck-up. This guy tweeted about it, who knows how many didn't even notice. It should have been opt-in, it should give user an indication that it's about to do this, etc.
I think there are arguments on both sides. People should look for guidance on how to use complex tools, but we know people will not.
Whose fault is it if someone drives a car without learning how to and injures themselves? On the other hand if the manufacturer has promoted it as one you can drive without learning how to, then whose fault is it?
A lot of users are fine with everything being uploaded. Most people's primary computing device is now a phone that backs up everything to cloud and using apps that are thin front ends over cloud services.
The grok-cli is on github[0] there is nothing that I can see in the code that is activily looping ~/ and uploading everything.
My two guesses would be one the LLM decided it needed these files for the task or two the user simple asked grok to do it so they could post the tool calls on twitter.
[0] https://github.com/superagent-ai/grok-cli
That is not the Grok CLI being discussed. That's an open source, third party CLI. https://x.ai/cli is the official Grok CLI being discussed, and it is not open source.
thanks for the correction
If your immediate reaction to a new piece of software siphoning up someone’s entire system full of highly personal data is, “you’re holding it wrong”, it might help to take a beat and remember that software was developed by a multi-trillion dollar company’s entire business model revolves around siphoning up as much highly personal data as possible
Well said. I hope one day it becomes possible for users who choose to install and run said software to also be able to remember this.
When I give my text editor or file browser access to everything I wouldn't expect it to exfiltrate data without asking.
Isn’t a file browser running locally, while Grok is running on someone else’s server?
The point is more that you should not blame the user (why didn't you set up sandbox instead of directly using the tool of big corp) if a tool does something unexpected. If your Dropbox client would suddenly just upload your home directory instead of it's folder you configured you'd also not blame the user that they use Dropbox, you'd blame Dropbox for not doing their job correctly or being user hostile.
Agreed. You can still encourage people to use defense in depth without actively blaming them for not having the deepest moat imaginable. Software creators still have some responsibility
We are speedrunning the various phases of learning about victim-blaming, as a community.
It’s kind of wild to watch in real time, instead of over the decades it took society for SA.
Is it 'unexpected' when we've been hearing stories like this every week for 2 years now?
Not every Anthropic user follows HN or random X posts about these issues.
Stories about copilot messing things up made into regular newspapers...
Do Anthropic users consider themselves clever enough to not make the same mistakes as Microsoft?
Other ones aren't this invasive with user data.
not true, Claude code on its own often create artifacts and straight up upload private stuff to Anthropic, without asking for it.
Then show us the example of Claude uploading a home directory to Anthropic because we have an example of Grok uploading a home directory to X.
Are we sure about that?
Codex is opensource, there are other opensource harnesses.
But Claude Code, arguably one of the most famous ones, is not. And recently got some heat about sending meta data that wasn't so obvious. Just as a counter-example.
https://xcancel.com/a_green_being/status/2076598897779020159
Posting a complaint about Elon on Elon's platform and tagging him is ballsy. He tends to limit visibility of accounts who do that.
ballsy only if you care about participating in that shithole of a platform.
Why is that page not there anymore?
Weird, right? Especially on a website with an owner who so ardently supports free speech. </heavy sarcasm>
https://x.com/a_green_being/status/2076598897779020159
the post has been deleted!! So much for freedom of speech.
The post is still there: https://x.com/a_green_being/status/2076598897779020159
Not sure which weirdness happened here
Dupe: https://news.ycombinator.com/item?id=48892512
Rules don't apply to certain CEOs.
You have to put them into a RULES.md of course!
Closed source coding agents are just complete info stealing malware. Both Claude and Grok were caught stealing info from your own machines.
This is why it is important to use open source harnesses instead of shady closed ones.
screenshot of the tweet, back it up :)
https://ibb.co/ycs6K4c9
Run your agents in podman containers.
Or don't use closed source harnesses at all.
Is the Grok CLI a 2 terabyte install? Did Elon dropship you an 8U rack of B200s?
No?
Well the model weights, the GPUs, and the context obviously all have to be in the same place, so “sending your project to them” is literally the only thing that could possibly happen, unless you think agents work by fucking magic.
This is the biggest case of PEBKAC in history, maybe ever.
This is the kind of confusion that Charles Babbage could not rightly comprehend, except at those politicians at least had the excuse that computers had only been invented five minutes prior.
Haha so just send over your entire home directory including password managers and home videos every time you need some python code rewritten.
Only a buffoon would be confused by the straightforward logic.
If you decide that your entire home directory is the project, as the OP did by setting the repo_path to ~/, then, well… I mean, if you ask me, I don’t recommend it, but it’s your computer and your free will.
You’re telling me LLMs aren’t actually magic?
It's fascinating how many people in this conversation think that LLMs need to have all of the files in your $CWD on the model provider's servers to be able to do anything.
Copied this from discord:
Some more discussion: https://news.ycombinator.com/item?id=48892512
Alex Karp was right, AI Compagnies are stealing people code while making them pay for unproductive tokens