xAI, SSH 키 유출 및 데이터 업로드 — Grok-Build 오픈소스 공개로 대응
xAI는 에이전트가 SSH 키, 비밀번호 등 민감한 파일을 자사 클라우드 서버에 업로드한 사실이 밝혀진 후, Grok Build의 844,530줄 분량의 Rust 소스 코드를 공개했습니다.
Facing backlash for security risks, xAI has open-sourced its Grok Build agent on GitHub under the Apache 2.0 license after users discovered the terminal tool uploaded entire directories, including SSH keys and passwords, to Google Cloud. The 844,530-line Rust codebase, which includes the agent loop, tools, and terminal UI, now supports local-only execution and has the data upload feature disabled by default. This transparency effort allows developers to audit the code and run the agent locally, mitigating fears of data exfiltration. The incident highlights the security risks inherent in AI coding agents that require broad file system access.