3 ms·

This wasn't the LLM, it was Grok CLI preemptively uploading the entire CWD, regardless of where that CWD is, to its own server. I don't think it is reasonable

by wolttam 3mo ago

This wasn't the LLM, it was Grok CLI preemptively uploading the entire CWD, regardless of where that CWD is, to its own server. I don't think it is reasonable to expect every user (including those just starting out with the tools - maybe experimenting, maybe younger/less experienced in general) to think that the tool they're running for the very first time is going to automatically exfiltrate all of their data. It's a pretty serious fuck-up. This guy tweeted about it, who knows how many didn't even notice. It should have been opt-in, it should give user an indication that it's about to do this, etc.

vorticalbox 3mo ago
The grok-cli is on github[0] there is nothing that I can see in the code that is activily looping ~/ and uploading everything. My two guesses would be one the LLM decided it needed these files for the task or two the user simple asked grok to do it so they could post the tool calls on twitter. [0] https://github.com/superagent-ai/grok-cli https://github.com/superagent-ai/grok-cli
- winstonp 3mo ago
  That is not the Grok CLI being discussed. That's an open source, third party CLI. https://x.ai/cli https://x.ai/cli is the official Grok CLI being discussed, and it is not open source.
  - vorticalbox 3mo ago
    thanks for the correction
graemep 3mo ago
I think there are arguments on both sides. People should look for guidance on how to use complex tools, but we know people will not. Whose fault is it if someone drives a car without learning how to and injures themselves? On the other hand if the manufacturer has promoted it as one you can drive without learning how to, then whose fault is it? A lot of users are fine with everything being uploaded. Most people's primary computing device is now a phone that backs up everything to cloud and using apps that are thin front ends over cloud services.
- butlike 3mo ago
  Every driver needs to learn how to drive, that's why it's called a "driver's license"
  - dbalatero 3mo ago
    Unfortunately, I don't think AI companies will opt to throttle onboarding new users via a licensing/training system.
  - graemep 3mo ago
    Exactly my point, but we are clear enough about that (because of the danger to others) to make it a legal requirement.
- marshray 3mo ago
  Whose fault is it if a manufacturer sells a car that begins accelerating as soon as it's turned on? It's the manufacturer's fault. Because that's not a reasonable thing for a car to do.

by wolttam 3mo ago

vorticalbox 3mo ago

The grok-cli is on github[0] there is nothing that I can see in the code that is activily looping ~/ and uploading everything. My two guesses would be one the LLM decided it needed these files for the task or two the user simple asked grok to do it so they could post the tool calls on twitter. [0] https://github.com/superagent-ai/grok-cli https://github.com/superagent-ai/grok-cli

winstonp 3mo ago
That is not the Grok CLI being discussed. That's an open source, third party CLI. https://x.ai/cli https://x.ai/cli is the official Grok CLI being discussed, and it is not open source.
- vorticalbox 3mo ago
  thanks for the correction

graemep 3mo ago

I think there are arguments on both sides. People should look for guidance on how to use complex tools, but we know people will not. Whose fault is it if someone drives a car without learning how to and injures themselves? On the other hand if the manufacturer has promoted it as one you can drive without learning how to, then whose fault is it? A lot of users are fine with everything being uploaded. Most people's primary computing device is now a phone that backs up everything to cloud and using apps that are thin front ends over cloud services.

butlike 3mo ago
Every driver needs to learn how to drive, that's why it's called a "driver's license"
- dbalatero 3mo ago
  Unfortunately, I don't think AI companies will opt to throttle onboarding new users via a licensing/training system.
- graemep 3mo ago
  Exactly my point, but we are clear enough about that (because of the danger to others) to make it a legal requirement.
marshray 3mo ago
Whose fault is it if a manufacturer sells a car that begins accelerating as soon as it's turned on? It's the manufacturer's fault. Because that's not a reasonable thing for a car to do.