Programmer Humor

SpaceXAI's AI coding tool Grok Build has been exposed for defaulting to uploading entire Git repositories, including code that the tool itself hasn't read or contextual calls, as well as the full Git commit history. A 12GB of repository data was sent to Google Cloud, where Grok Build uses Google GCP to store the collected data. If you run this on a sensitive stack, your entire repo is already compromised regardless if it's public or not. It's literal spyware.

Shipping source code to the cloud is bad enough, but blindly inhaling .env.local and .dev.vars in a background sync is absolute negligence. They are vacuuming up raw api keys, database credentials, and private nodes directly to GCP.

If you ran this locally, your private keys are now sitting on a remote server. consider every secret burned, treat your bare metal as completely compromised, and rotate your entire stack immediately.

Grok Build quietly adjusted its cloud strategy last night to stop uploading data, which further suggests that it was a conscious decision rather than a bug. The problem, however, is that development teams can re-enable data collection options from the cloud at any time, Grok Build is not open source and therefore nobody can do a code audit.

Edit: sorry I didn't realize I already posted this

cross-posted from: https://slrpnk.net/post/40088294

cross-posted from: https://piefed.social/c/lemmyshitpost@lemmy.world/p/2201760/definitely-not-recording

cross-posted from: https://lemmy.world/post/49112030

Crossposted from https://lemmy.world/post/49163864

CommitStrip | website

cross-posted from: https://lemmy.world/post/49115945

cross-posted from: https://lemmy.world/post/49015603

cross-posted from: https://discuss.online/post/42119737

BTW I think some anti-Rust people are more annoying than the worst Rust evangelists - seen some of them calling people not using Rust as "murderers", because "memory leakage can kill at the right time" - but that's due to them being evangelists to right-wing politics.