[Geee]

Isn't it assumed that the AI agent is allowed to read your files in the directory you launch the harness? Most agents read your code on the first prompt, including any secrets you have there, which you shouldn't have. Also the .env file is for local environment, and shouldn't contain any actual secrets. AI agents should be isolated from any actual secrets, because they can't be trusted to follow instructions.

If you adjust your expectations, I think it's be better to upload the code to their servers instead of sending it through context over and over again.

[dminik]

It will have to be sent through the context again. That's how LLMs work.

The only reason to do this is so that Musk has clean training data for his next model. Project setup, popular libraries, CI workflows, etc.

[timr]

> Isn't it assumed that the AI agent is allowed to read your files in the directory you launch the harness?

Yes. There's very little story here. Maybe Grok is being like 10% more aggressive than other providers in how they assemble context (more likely: it was faster to ship this way), but any provider has the ability to do the same thing, and will happily do it if it helps improve results. Authors acknowledge this openly, but it's buried:

> "Cloud AI tools send context; this is normal." True, and conceded: any cloud coding agent must send code to its server to act on it. The novel deltas here are (a) a secrets file (e.g. .env) is transmitted unredacted, (b) the content is persisted to a named GCS bucket, not just processed transiently, and (c) the upload mechanism is not surfaced in the CLI's setup materials (§7) and on by default.

This is the entire controversial portion of the finding, in a single paragraph.

As far as the .env thing goes, you shouldn't be putting unencrypted .env files in the accessible path of any LLM. If you do, you're asking for trouble. It would obviously be better if Grok identified secrets and ignored them, but this is not a behavior you should rely on.

[edg5000]

Even if it's uploaded once, it's still being ran through inference. It saves a bit of HTTP traffic I suppose.