xAI Grok Build CLI Found Uploading Entire Repos Despite Privacy Toggle

·1 views

In July 2026, a researcher known as cereblab discovered that xAI's Grok Build CLI (version 0.2.93) was silently uploading entire code repositories to a cloud storage bucket during coding sessions. The upload occurred via a second network channel separate from the model's own data requests, sending roughly 5.10 GiB as a full git bundle — including complete commit histories — compared to just 192 KB used by the actual task. The researcher confirmed the behavior using a canary file the agent was explicitly told never to read, yet its contents appeared verbatim in the captured upload. Critically, xAI's in-app privacy toggle, which was labeled around model-training consent, had no effect on this client-side upload path, meaning users had no functional control over the data transfer. The incident highlights a broader risk for development teams: AI coding agents may transmit far more data than the model itself requires, including sensitive historical credentials that were rotated but never fully erased from git history.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Two-Tier AI Code Review in CI Cuts Costs by Routing Low-Risk PRs Locally

A developer rebuilt their CI-integrated AI code reviewer after noticing high costs from sending every pull request diff to a large frontier model. The redesigned system uses a small local model as a first-tier triage filter, classifying diffs as low or high risk based on whether they touch sensitive areas like authentication, cryptography, or financial logic. Low-risk changes — such as formatting fixes, docs, and test updates — are stopped at the first tier with no expensive API call made. Only high-risk diffs are escalated to the large model, which uses prompt caching to avoid re-processing the stable system prompt and repo context on every review. The approach significantly reduces per-review costs while preserving meaningful oversight for the code changes most likely to introduce security or logic vulnerabilities.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds lifecycle monorepo to standardize training course folder structure

A developer consolidated scattered training course materials from multiple repositories into a single monorepo, assigning every course an identical five-stage numbered folder structure from planning to post-training follow-up. The numbered prefixes (00–04) enforce workflow order visually, mirroring how timestamped database migrations encode sequence as information. A _TEMPLATE directory lets users bootstrap a new course with one command, using placeholder tags to mark unfilled sections, and a simple grep check confirms completion when no placeholders remain. Retired materials are stored in a dated _ARCHIVED folder rather than deleted, preserving past decisions and the reasoning behind them. A root CLAUDE.md file documents all naming conventions and structural rules in a machine-readable format, making the system accessible to both human collaborators and AI coding agents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-Source SSI SDK Aims to Give Users Control Over Digital Identities

A Self-Sovereign Identity (SSI) SDK has been open-sourced to help individuals and organizations manage their digital identities without relying on a central authority. The framework is built on decentralized identifiers (DIDs) and verifiable credentials, allowing parties to issue and verify digital assertions cryptographically. The decision to open-source the SDK was driven by goals of fostering community innovation, improving transparency, and democratizing access to secure digital identity tools. Key features include DID management, blockchain integration, verifiable credential issuance, and cross-platform compatibility. Developers using the SDK are advised to follow strict security practices, including private key protection, regular audits, and keeping dependencies up to date.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Link Manual Test Cases to Playwright and Robot Framework Specs via Git

Software teams often store manual test cases separately from automated specs, making it difficult to accurately track automation coverage. A proposed workflow places both manual YAML test cases and automated specs in the same Git repository, assigning each manual case a stable ID based on its filename. Automated tests in Playwright or Robot Framework reference these IDs as tags, creating a reliable link between the two. Once the IDs match, a script or AI coding assistant can scan the repo and update the YAML files to mark cases as automated and record the corresponding spec path. This approach allows a single pull request to update the manual case, the automation spec, and the traceability link together.

0 comments Read more at DEV Community