xAI、SSHキーの漏洩とデータアップロード――その答えはGrok-Buildのオープンソース化
エージェントがSSHキーやパスワードなどの機密ファイルを自社クラウドサーバーにアップロードしていたことが発覚した後、xAIはGrok Buildの全844,530行にわたるRustソースコードを公開した。
Facing backlash for security risks, xAI has open-sourced its Grok Build agent on GitHub under the Apache 2.0 license after users discovered the terminal tool uploaded entire directories, including SSH keys and passwords, to Google Cloud. The 844,530-line Rust codebase, which includes the agent loop, tools, and terminal UI, now supports local-only execution and has the data upload feature disabled by default. This transparency effort allows developers to audit the code and run the agent locally, mitigating fears of data exfiltration. The incident highlights the security risks inherent in AI coding agents that require broad file system access.