SpaceXAI’s AI coding tool Grok Build has been exposed for defaulting to uploading entire Git repositories, including code that the tool itself hasn’t read or contextual calls, as well as the full Git commit history. A 12GB of repository data was sent to Google Cloud, where Grok Build uses Google GCP to store the collected data. If you run this on a sensitive stack, your entire repo is already compromised regardless if it’s public or not. It’s literal spyware.
Shipping source code to the cloud is bad enough, but blindly inhaling .env.local and .dev.vars in a background sync is absolute negligence. They are vacuuming up raw api keys, database credentials, and private nodes directly to GCP.
If you ran this locally, your private keys are now sitting on a remote server. consider every secret burned, treat your bare metal as completely compromised, and rotate your entire stack immediately.
Grok Build quietly adjusted its cloud strategy last night to stop uploading data, which further suggests that it was a conscious decision rather than a bug. The problem, however, is that development teams can re-enable data collection options from the cloud at any time, Grok Build is not open source and therefore nobody can do a code audit.
“… but unannounced no response”… literally what is this title trying to say?!
But thank you for providing a great summary 🧡
but blindly inhaling .env.local and .dev.vars in a background sync is absolute negligence. They are vacuuming up raw api keys, database credentials, and private nodes directly to GCP.
anyone expecting anything else from mechahitler is a fucking retard.
I never have ai connect to my code, even the one corporate runs. I’ll use it for rubber duck debugging but don’t trust it to have direct access.
Do just greenfield projects. Add no secrets. Only use publicly available data.
Should mostly be fine as long as you’re going to publish the code anyway.
well, have luck while the corpo LLM is fucking you over. I hope your project survives without bein inhaled by the big LLMS,
Yeah, they are still using other companies models but it’s self hosted on our own hardware. I treat it as a Google search most of the time better but sometimes it gives me a GitHub link that never existed or a command option that exists for a different cli tool but not the one I’m using.
