SpaceXAI's AI coding tool Grok Build has been exposed for defaulting to uploading entire Git repositories, including code that the tool itself hasn't read or contextual calls, as well as the full Git commit history. A 12GB of repository data was sent to Google Cloud, where Grok Build uses Google GCP to store the collected data. If you run this on a sensitive stack, your entire repo is already compromised regardless if it's public or not. It's literal spyware.

Shipping source code to the cloud is bad enough, but blindly inhaling .env.local and .dev.vars in a background sync is absolute negligence. They are vacuuming up raw api keys, database credentials, and private nodes directly to GCP.

If you ran this locally, your private keys are now sitting on a remote server. consider every secret burned, treat your bare metal as completely compromised, and rotate your entire stack immediately.

Grok Build quietly adjusted its cloud strategy last night to stop uploading data, which further suggests that it was a conscious decision rather than a bug. The problem, however, is that development teams can re-enable data collection options from the cloud at any time, Grok Build is not open source and therefore nobody can do a code audit.

I promise I wasn't reading it, I was traveling across it.

Manager: We (meaning you) need to do task A. How long will it take?

Me: Task A will take X days to do.

Manager: That seems awful long.

Me: How long do you think it should take?

Manager: It surely could not take any longer than Y days.

Me: Ok, it seems you have an answer to your question then.

Later:

Manager: It’s been Y days, why isn’t task A done yet?

Because nothing gets you promoted faster than a six-figure token bill

A bash one-liner that burns Claude Code or Codex tokens on purpose.

Be the most productive engineer on your team 🚀🚀🚀!

Oh wait…is it Al or AI?