全部文章0
Hacker Newsjhoho··访问 1

What xAI's Grok build CLI sends to xAI: A wire-level analysis

原网页

Article URL: https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547

Comments URL: https://news.ycombinator.com/item?id=48877371

Points: 390

# Comments: 153

Hacker News 讨论

391 points · 154 comments · 查看原帖

  1. phaseleza

    I always separate the coding tools from LLM providers, and use bubblewrap to sandbox the coding tools so they: 1. Can only read the working project directory, with .git read-only and sensitive directories hidden (mounted as empty directories). 2. Have an isolated network namespace; they can only access the internet through an HTTP proxy hosted on a Unix socket, can only access specific LLM provider hostnames, and exclude the tool's own hostname. For example, with Crush, I will let it access *.openrouter.ai (LLM providers) but not *.charm.land (Crush's domain for auto-updating the LLM list). This makes me feel much more comfortable enabling "yolo" mode and letting the tools do everything.

  2. WhyNotHugo

    The first item is "a file in the repository which contains secrets was read by the model". Well yeah, obviously, that's pretty much intended behaviour. The LLM can't determine that there are secrets in your file before reading them. The real issue here is that you're giving an LLM access to a file with plain-text secrets and then surprised that it reads that file. The fact that the whole repo is automatically uploaded is crazy though, especially for multi-gigabyte repositories. This could take a long time on some connections, and seems generally pointless ­— unless there's some ulterior motive for uploading all this data.

  3. gitgud

    This is one of the reasons why native proprietary coding agent runners like claude-code, codex, grok-build etc are so dangerous for privacy… you just don’t know what “secret sauce” they’ll add in the next update… It’s much safer to use something like opencode and use models via their API… however, the tradeoff is that it will never perform as well as it does in their native agent runners…

  4. freakynit

    "It uploads the whole repository — every tracked file's content plus git history — independent of what the agent reads" Holy cow!!!! I mean I kinda expected Elon would do something like this to try to catch-up.. but this is extremely concerning. This is precisely the reason, even though their pricing is competitive and grok-4.5 is actually good enough, I chose not to go with them.

  5. Karmakosmik

    Isn't that expected? I always assumed the agent owns (at least) the current workspace (whatever dir it's launched in) and so can do whatever it wants in there. If they actually use this try and do things in the backend and saving prompt RTTs and tool calls that would be in my interest, no?

  6. j_bum

    I wish a human would’ve written the overview. Nonetheless, this is disturbing.

  7. 5701652400

    will this endup in their "macrohard" (automate any business) project? will this endup in their "everything app"? guess you do not need to build "everything" yourself, when you can steal it.

  8. Geee

    Isn't it assumed that the AI agent is allowed to read your files in the directory you launch the harness? Most agents read your code on the first prompt, including any secrets you have there, which you shouldn't have. Also the .env file is for local environment, and shouldn't contain any actual secrets. AI agents should be isolated from any actual secrets, because they can't be trusted to follow instructions. If you adjust your expectations, I think it's be better to upload the code to their servers instead of sending it through context over and over again.