Seen In Crows

Call me paranoid, but I think we need to put all CLI tools in a jail. Any attempt to access sensitive contents like .env, .dev.var, or SSH keys should be guarded by the user's explicit authorization. Some people would say: oh, Claude already has it; if you don't pass the --dangerously-skip-permissions flag, it would ask for permission every time. Yes, you're right, but there are issues: - we can't rely/trust on the built-in permission check within those CLIs. - people have already made that --dangerously-skip-permissions the default. - we need an open-source guard people can trust and verify. It should be as lightweight as possible without affecting normal functionality. any more to add?

We care deeply about your privacy and respect customer choice. For teams using zero data retention, no trace and code data is ever retained. All API key use of Grok Build also respects ZDR. If ZDR is disabled, the /privacy command is available in the CLI to disable data retention, which also deletes previously synced data. Run the /privacy command to view or change your settings at any time.

i've been recommending Grok because they genuinely have a good model and harness and that makes me extremely disappointed to see that they would choose to secretly upload people's codebases including files that contained credentials run /privacy in your grok build asap to opt-out if you haven't yet. i also set the following options in my ~/.grok/config.toml i almost decided to buy the $300 supergrok heavy as my 3rd subscription, and this broke the deal i hope companies realize user trust is very hard to regain, and think twice before doing something like this

it's shocking that some people in the comment section actually tried to defend and justify Grok Build silently uploading people's entire codebases and credentials let me summarize the key arguments and my responses 1. "everyone else is doing it" umm.. no?? this is an absolute outlier. there isn't a single mainstream harness that proactively uploaded entire codebases wholesale, including files not required to process your prompt, and including files that contain credentials, without explicit user consent people who say this have a low-resolution understanding that "AI apps use your data" and likely know nothing beyond that and even putting facts aside, what kind of logic is that? if you walked into a neighborhood and you see someone using drugs, then it's okay to use drugs? we have laws and regulations that defined what's okay. what grok did violated GDPR, CCPA, FTC Act, and potentially HIPAA, GLBA and many other regulations in various jurisdictions 2. "you agreed with their TOS which allowed them to do this" umm.. no?? go read their TOS - what we agreed with says they can collect data directly from our prompts. what they are doing now is far beyond that it's funny people who use this argument often didn't read or comprehend what's really covered by their TOS. again, low-resolution understanding that "TOS gives them the rights to do everything" - no it doesn't 3. "just get over it. your data is not that valuable" umm.. no?? if it's not valuable it will not get collected. also, whether i consider my data valuable or not is up to me and me alone, not every random company a lot of my code is open source with MIT - i already shared what i want to share. i'm not going to "get over it" and share my production credentials to a 3rd party private server who may very well leak it to god knows where we also have moral standards and expectations. if we start to normalize and accept this kind of behavior, we will eventually live in a world where our TV may be watching us, and our bathroom mirror may have a camera and microphone. is that a world you want to live in? i don't, hence i'm voting with my feet - i was considering buying the $300/month plan and now i'm not it's going to be a tough long road for xAI to repair this damage in user trust. my recommendation: - immediate public apology acknowledging the misstep. don't call it a bug, an accident, or something unintended. it was a bad but deliberate decision, so call it what it is - be transparent about why that decision was made, and what's being done systematically in the organization to prevent similar decisions from being made ever again - cursor should make a public statement asap to clarify whether and how it's separate from this practice. people are starting to worry whether cursor will do the same given the acquisition. if cursor is clean and can stay clean, make it clear, and xAI should consider doubling down on Cursor as the more trusted brand to deliver the value of the Grok model

Jensen Huang was asked what NVIDIA's single biggest moat is. The most valuable company in the world. He didn't point to the chips. He said a competitor could clone CUDA exactly and it wouldn't matter. "if somebody came up with a GUDA or TUDA it wouldn't make any difference at all." That is the reframe. And it changes what NVIDIA is actually defending. The conventional story is that NVIDIA wins on silicon. Faster GPU, better transistors, more FLOPS. Which means the day someone ships a faster chip, the game is over. Every competitor is racing on that assumption. Jensen is defending something else entirely. He said it wasn't three people who made CUDA win. It was 43,000 people and several million developers who bet their software on it. The moat isn't the hardware. It's the install base. Now here's where it gets interesting. Put yourself in a developer's seat. Target CUDA and you reach a few hundred million machines: every cloud, every computer maker, every industry, every country. And the platform gets roughly 10x better every six months, for free, while you wait. A rival could ship a chip that is genuinely faster and still lose, because no rational developer ports a mountain of software off a platform that already owns the install base and improves itself every two quarters. He is not selling the best chip. He is renting out the largest install base in computing. The open question is whether better silicon can ever beat that, or whether the only way past a moat like this is to make the whole category obsolete.

We care deeply about your privacy and respect customer choice. For teams using zero data retention, no trace and code data is ever retained. All API key use of Grok Build also respects ZDR. If ZDR is disabled, the /privacy command is available in the CLI to disable data retention, which also deletes previously synced data. Run the /privacy command to view or change your settings at any time.

A simple command will show you if something was uploaded: cat ~/.grok/logs/unified.jsonl | grep repo_state.upload