[kordlessagain]

Mitigation for use:

  ```
  export GROK_TELEMETRY_TRACE_UPLOAD=0
  export GROK_TELEMETRY_ENABLED=0
  # or config file with [telemetry] trace_upload = false, [harness] disable_codebase_upload = true  
  ```

The practical takeaway for users: your entire codebase leaves (uploaded) your machine unencrypted on each Grok Build invocation, not just files you ask it to read, and no visible setting stops it.

I've built Nemesis8 (n8) for blast radius control and monitoring these sorts of things, from containers: https://github.com/deepbluedynamics/nemesis8

I've added the mitigation above to the image build for Grok Build instances. There is a lot of telemetry already turned on in n8 containers, so will investigate further.