The Grok Build leak (check this link out to catch up: Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read) highlights a difficult reality in AI security: a coding agent marketed as private can still quietly ship your entire codebase out the door. Researchers found that xAI’s Grok Build CLI uploaded entire git repositories, full commit history and untouched files included, to a Google Cloud Storage bucket xAI controlled, no exploit required, no unusual configuration, just a normal coding session that carried .env secrets and SSH keys out along with it.
Yusif Mukhtarov, Lead Data Scientist, Polygraf AI had this to say:
“To be very honest, Grok 4.5 seems to have solved one of the biggest barriers that previously limited its practical use: API cost. As an ML engineer, I personally found earlier versions too expensive to integrate into daily workflows and use consistently at scale. With Grok 4.5, that balance has changed. The model is capable, fast, and affordable enough to become part of real engineering operations. It is obvious that an enormous amount of effort went into building it, and considering the combination of its price and capabilities, I personally believe it is revolutionary to a certain degree. That is why this incident is particularly surprising and concerning. In my opinion, it exposes a major blind spot in how we currently evaluate agentic systems. We celebrate improvements in coding accuracy, task completion, cost, and latency, but these scores tell us very little about whether the surrounding product follows the principle of least privilege, exports only the context required for the task, or creates additional data flows that remain invisible to the user. A model can solve a task perfectly while the system built around it still collects far more information than the task requires. In this case, even auditing the model’s visible actions may not have been enough, because the reported repository upload occurred through a separate storage mechanism. This case also shows that evaluating only the model’s observable behavior is not enough, because critical data flows may be handled by the surrounding application infrastructure rather than by the model itself.
The problem is therefore deeper than the behavior of one model or one company. Whenever sensitive information is sent to an external provider, we are not only trusting that provider to act fairly and follow its privacy commitments. We are also trusting that every part of its infrastructure, software, storage configuration, access control, and internal process will continue to work correctly. Even a responsible company can suffer from a bug, a configuration mistake, an internal incident, or a security breach. Courts and regulators may later hold the responsible party accountable and compensate the victim, but they cannot reverse the disclosure or fully repair the damage once sensitive information has escaped. Personally, I see the solution as reducing the consequences of failure rather than assuming failure can always be prevented. Sensitive entities should be detected locally and replaced with neutral terms such as person, organization, location, or account before the data reaches any external model or agent. This does not make third party systems infallible. It makes their failures significantly less damaging because the original sensitive information was never available to leak in the first place. This is exactly the privacy approach we are developing at Polygraf AI.”
AI isn’t the magic bullet that you think it is. And anything controlled by Elon Musk must be treated as doubly suspect by default if AI is treated as suspect by default. Because anything AI can’t be completely trusted.
Department Of War just suspended CMMC Phase II
Posted in Commentary with tags Department Of War on July 14, 2026 by itnerdThe Department of War’s suspension of CMMC Phase II is being covered as a compliance win for small and mid-size defense contractors, and in terms of bureaucratic burden, it is. But the third-party verification that Phase II provided doesn’t disappear without consequence; the DFARS clauses creating personal liability for affirming officials are still fully in force.
More details are here: Pentagon announces ‘immediate suspension’ of CMMC Phase II mandates – Breaking Defense
Justin Beals, CEO & Founder, Strike Graph, an AI-native GRC and compliance automation platform
“This isn’t a security stand-down. It’s a stand-down on who checks your homework. Phase I self-assessment stays in place, but the third-party verification that would catch a bad self-assessment doesn’t.
That matters because DFARS 252.204-7012 and 252.204-7021 didn’t go anywhere. Affirming officials are still personally exposed under the False Claims Act for a compliance claim nobody independently verified, the exact gap that produced the $4.6 million MORSECORP settlement.
Companies that treat this suspension as permission to stop building evidence will be the ones exposed when the Reform Task Force’s review lands in 60 days, or when an incident forces the question first. Self-attestation was never the finish line. It was always a claim waiting to be tested.”
This will be a #fail. I am calling it now as we need more cybersecurity not less. But I guess that the find out moment will come when people and organizations get pwned.
Leave a comment »