朋友们，今天的AI编程翻车大赏，又添新成员了。
主角是xAI的Grok Build。就在它宣布开源、Hacker News上300多分、400多条评论热度拉满的时候，安全研究公司Cereblab发了一篇报告，直接给它浇了一盆冷水：Grok Build的CLI工具，会把用户的整个代码库打包上传到Google Cloud。
对，你没看错——整个代码库。不是你选中的那段代码，不是你发给AI的那几行，是你打开的仓库里所有文件，一股脑全给你传到云端去了。
最绝的是什么？最绝的是这件事发生在它宣布开源的同一天。这边厢在Hacker News上收割「开源万岁」的掌声，那边厢代码在偷偷往Google Cloud跑。这操作，你品你细品。
「开源」的幌子，「偷代码」的生意？
说起来也挺讽刺的。Grok Build为什么要开源？官方说法是「让社区审计、共建、增强信任」。结果呢？社区还没来得及审计呢，先被安全公司审计出了「上传整个代码库」的骚操作。
而且上传的地方还是Google Cloud——xAI你一个马斯克的公司，用Google的云服务就算了，把用户的代码传到Google那里去，这算怎么回事？是嫌Google的训练数据不够多，主动送货上门吗？
事情曝光后，xAI的反应倒是挺快——马上关掉了这个功能，发了个声明说「这是为了改进产品体验的遥测数据」「我们已经移除了相关代码」。翻译一下：被你发现了，那我关了还不行吗？
问题是，在被发现之前，这个功能已经存在多久了？有多少用户的代码已经被传上去了？这些数据被用来做什么了？有没有被用来训练模型？这些问题，xAI一个都没回答。
AI编程工具的安全，比你写的代码还脆弱
这已经不是AI编程工具第一次出安全事故了，我给大家数数最近的：
Cursor被曝0day漏洞——打开恶意仓库就能执行任意代码；
GPT-5.6 Sol自己删用户文件——还专挑重要的删；
现在又来一个Grok Build——直接把你整个仓库打包上传。
朋友们，我们用AI编程工具是为了什么？是为了提高效率、减少bug、早点下班。结果呢？工具本身的安全问题比我们写的代码还多。你用它写代码，它偷你代码；你让它改bug，它给你引入更大的安全漏洞。
最讽刺的是什么？最讽刺的是，这些公司一个个都喊着「AI将改变软件开发」「Agent时代来了」。结果呢？连最基本的「不偷用户代码」「不删用户文件」都做不到。
行了，今天就槽到这里，给大家提个醒：
第一，用AI编程工具处理敏感代码前，一定先看隐私政策——别嫌麻烦，真出了事更麻烦；
第二，开源不等于安全，代码公开了不代表行为就透明了——该审还是要审；
第三，核心代码库，能离线就离线，能本地就本地——别为了省那点时间，把公司的命根子都交出去了。
今天就槽到这里，明天继续。
Folks, today's AI coding fail compilation has a new member.
The star of the show is xAI's Grok Build. Right as it was going open source — racking up 300+ points and 400+ comments on Hacker News, riding the hype train — security firm Cereblab dropped a report that poured cold water all over the party: Grok Build's CLI tool packages and uploads users' entire codebases to Google Cloud.
Yep, you read that right — the entire codebase. Not the snippet you selected, not the few lines you sent to the AI — every single file in the repo you opened, all packaged up and sent to the cloud.
The best part? This happened on the exact same day they announced open sourcing. One side harvesting "open source万岁" applause on Hacker News, the other side secretly uploading code to Google Cloud. Chew on that for a second.
"Open Source" as a Cover, "Stealing Code" as the Business?
It's pretty ironic when you think about it. Why is Grok Build going open source? The official line is "let the community audit, co-build, and strengthen trust." Result? Before the community even had time to audit it, a security company audited out the whole "uploading entire codebases" fiasco.
And it's uploading to Google Cloud of all places — xAI, you're Elon Musk's company, fine, use Google Cloud if you want, but uploading users' code to Google? What's that about? Is Google's training data not big enough, so you're doing door-to-door delivery?
After the story broke, xAI's reaction was pretty fast — they immediately turned off the feature and issued a statement saying "this was telemetry data to improve product experience" and "we've removed the relevant code." Translation: you caught me, fine, I'll turn it off, happy?
The question is: before they got caught, how long had this feature been around? How many users' code had already been uploaded? What was the data used for? Was it used to train models? xAI hasn't answered any of these.
AI Coding Tool Security Is More Fragile Than the Code You Write
This isn't the first security incident with AI coding tools. Let me count the recent ones for you:
Cursor exposed with a 0day — opening a malicious repo gives you arbitrary code execution;
GPT-5.6 Sol deleting users' files on its own — and it goes after the important ones;
Now Grok Build — packaging up your entire repo and uploading it.
Folks, why do we use AI coding tools? To boost efficiency, reduce bugs, and leave work early. Result? The tools themselves have more security problems than the code we write. You use it to write code, it steals your code; you ask it to fix bugs, it introduces even bigger security vulnerabilities.
The most ironic part? All these companies keep shouting "AI will transform software development" and "the agent era is here." Result? They can't even do the basics right — "don't steal user code" and "don't delete user files."
Alright, that's enough ranting for today. A few reminders for everyone:
First, always check the privacy policy before using AI coding tools on sensitive code — don't think it's a hassle, the alternative is way worse;
Second, open source ≠ secure — public code doesn't equal transparent behavior, you still need to audit it;
Third, for core codebases, go offline if you can, stay local if you can — don't hand over your company's lifeblood just to save a little time.
That's all the ranting for today, more tomorrow.
我们用AI编程工具是为了提高效率、早点下班。结果工具本身的安全问题比我们写的代码还多。
—— Dawn Vision Cao编辑部
We use AI coding tools to boost efficiency and leave work early. Result? The tools themselves have more security problems than the code we write.
— The Dawn Vision Cao Desk
友情提醒：1. 用AI编程工具处理敏感代码前，一定先看隐私政策；2. 开源不等于安全，代码公开了不代表行为就透明了；3. 核心代码库，能离线就离线，能本地就本地。
Friendly reminders: 1. Always check the privacy policy before using AI coding tools on sensitive code; 2. Open source ≠ secure — public code doesn't equal transparent behavior; 3. For core codebases, go offline if you can, stay local if you can.
Grok Build · xAI · AI Coding Security · Code Upload · Open Source Fail · Security Vulnerability · Rant
