Bun revealed this week that a million lines of agent-written Rust had already landed on main, and no human ever reviewed them line by line.
The work itself ran back in May. What happened this week was Bun publishing the receipts: about 50 Claude Code workflows running continuously over 11 days, peaking at four workflows in separate git worktrees with 16 Claudes each. About 64 agents at once. The diff that landed on main was +1,009,272 lines. At peak, Claude was writing 1,300 lines of code per minute. Zero tests were skipped or deleted.
Then the internet read it, and the interesting thing happened. The rebuttal outscored the announcement.
Here is the actual scoreboard from Hacker News this week, and it tells the story better than any of the individual posts do:
pgrust. Then the rebuttal. Then the announcement.
A Postgres-in-Rust rewrite built by AI agents took 817 points. Zig creator Andrew Kelley’s takedown of the Bun rewrite took 788. Bun’s own announcement of the thing everyone was talking about took 785. (Live counts as of Monday morning, July 13. The order has held all weekend, though these are moving counters.)
The critique outranked the achievement. That is not a hype cycle. That is an industry doing quality control in public, and it is the healthiest thing that happened this week.
🤖 The Fleet Merged a Million Lines. The Receipt Is Complicated.
Read the disclosure before you read the numbers
Bun’s post opens with a line most of the coverage skipped: “Bun was acquired by Anthropic in December 2025. I and others on the Bun team work at Anthropic. I used a pre-release version of Claude Fable 5 for much of the Rust rewrite.”
That reframes the headline figure. The rewrite consumed 5.9 billion uncached input tokens and 690 million output tokens, which Jarred Sumner prices at “around $165,000 at API pricing.” But that is a list price, for a pre-release model that was not purchasable, run by a team owned by the model’s vendor. It is not a bill anyone paid. It is not a number you can reproduce. Anyone telling you “a million-line rewrite now costs $165K” is quoting a hypothetical.
Kelley went straight at exactly this: “It’s almost like the marketing department of a trillion dollar company has a lot of money riding on this article.”
And his technical objection is the one that should keep you up at night. Bun’s defense of merging a million lines nobody reviewed line by line is that the test suite catches everything. Kelley’s response:
“Then why are you saying you have so many annoying bugs in the Zig code? What happened to the test suite being sufficient to catch everything? It’s not sufficient to catch bugs in Zig code but it is sufficient to catch bugs in 1 million lines of unreviewed slop?”
That is the test-suite paradox, and it is not a Zig-versus-Rust argument. It applies to you.
Be careful with it, though, because it is a real tension and not a strict contradiction. Both of Bun’s claims can hold at once: a conformance suite can validate externally observable behavior while Rust’s ownership and type system eliminates whole classes of memory bugs the suite never reliably exercised in the first place. Use-after-free is exactly the kind of defect that hides from tests and dies at the compiler.
But Kelley is still pointing at the thing that matters, and the honest version of his question is the one to take to your own codebase: what does your oracle actually encode, and what failures does it not? If the answer is “we do not know,” then a passing suite is not evidence of a correct port. It is evidence of a passing suite.
Be fair to Kelley on one point, because the framing matters: he is not a sore loser defending his language. “When Jarred announced the Rust rewrite, we were ecstatic.” He wanted this. He just does not accept the verification story. (Worth knowing: he has since edited the post’s conclusion after backlash, writing that he “had unprocessed emotions of resentment.” The version you read today is not the version that got those upvotes.)
Why it matters: The one-way door might not be one-way anymore. Choosing your implementation language has been the most expensive, least reversible decision in software since forever, and a fleet of agents plus a conformance oracle just made a million-line migration mechanical. That is genuinely new. But note carefully what Bun did not do: nobody performed a line-by-line human review of a million-line diff. Sumner monitored the workflows and corrected them at the process level, but the verification load was carried by the existing TypeScript test suite as a conformance oracle, plus two adversarial reviewer agents (also Claude). And merged is not shipped, in his own words: he was “not yet confident enough to release it.”
Hype vs. Reality: 7/10. The engineering is real and the numbers are primary-sourced. The economics are a vendor’s list price on a model nobody could buy.
🧪 The Same Week, A Postgres Rewrite Made a Bigger Claim
And the fine print does the work
pgrust is Postgres rebuilt in Rust by Michael Malis and Jason Seibel, using a fleet that “worked my way up to 17 different coding agents before maxing out the CPU on my computer.” They mostly used Codex, coordinated through Conductor, which handles git worktrees so agents do not trip over each other. It took 817 points on Hacker News, the highest score of the week.
The headline everyone repeated is that it passes 100% of the Postgres regression suite. Read the README more carefully than the headlines did:
“We’re working on a new not yet published version of pgrust that currently passes 100% of Postgres regression suite… is 50% faster than Postgres on transaction workloads, and is ~300x faster than Postgres on analytical workloads.”
The 100%, the 50% faster, the 300x faster: all of it describes code you cannot download. The claim that belongs to the artifact you can run is that pgrust “matches Postgres’s expected output across more than 46,000 regression queries.” That is a real and impressive result. It is not the same sentence.
To his credit, Malis is blunt where it counts: “pgrust is not production-ready yet. It is not performance optimized yet.”
Why it matters: The best objection in the thread is one every team pointing an agent fleet at a legacy system needs to internalize. Regression tests only encode the bugs somebody already found. What makes Postgres and SQLite trustworthy is not the suite, it is thirty years of production scar tissue, of hitting failure modes nobody thought to write a test for. An agent that passes 100% of the tests has proven it reproduces the known behavior. It has proven nothing about the unknown behavior, which is the part that pages you at 3am.
Hype vs. Reality: 5/10. The public artifact and its 46,000-query result are real and reproducible. The agent-throughput story is largely author-reported, and the “100%” is doing far more work than it can support.
📊 Your Harness Can Double Your Model Bill
This is the most useful thing anyone published this week
While everyone argued about agent fleets, Databricks quietly benchmarked them on its own multi-million-line codebase, using real tasks its own engineers had actually completed. The findings should change how you budget.
Finding one: per-token pricing is lying to you.
“Sonnet 5 is ~1.7x cheaper per token than Opus 4.8, but, on our tasks, we found that Sonnet cost $2.09/task vs Opus’s $1.94, while scoring six points lower on task completion (81% vs 87%). This was mostly because Sonnet 5 worked longer and read more to get there, consuming 1.9x more tokens.”
Read that again. The cheaper model was more expensive per task and worse at the task. Not because of pricing, but because it burned 1.9x the tokens getting there. If you picked your model off a pricing page, you picked wrong, and you would never see it in the invoice line item.
Finding two, and this is the one nobody is talking about:
“When we ran the same model with the same thinking effort through two different harnesses (Claude Code/Codex vs Pi), we observed that the cost per task differed significantly (more than 2x in some cases), while quality remained the same.”
Same model. Same reasoning effort. Same quality. More than double the cost. The variable was the harness, because one of them shoved far more context into every turn. On this benchmark, harness choice mattered at least as much as model choice, and almost nobody is measuring context-per-turn. Databricks is careful to say this does not mean one harness is always cheaper, and neither do we. It means the variable is real, it is large, and it is probably invisible to you right now.
Why it matters: If you are optimizing agent spend by shopping models, you are optimizing the wrong variable. Instrument context-per-turn before you switch vendors. GLM 5.2 came in at $1.28/task against Opus 4.8’s $1.94 while statistically tied on quality, which is the number the “cheap open models are catching up” crowd will quote. Fine. But the harness result is the one that saves you money this week, without changing a single dependency.
The caveat, stated loudly because Databricks states it too: this is a vendor’s self-published benchmark on a private codebase that nobody outside Databricks can reproduce. They built it on their own merged PRs precisely because public benchmarks leak into training data. Trust the direction. Do not treat the dollar figures as universal.
Hype vs. Reality: 8/10. Self-published and unreproducible, and still the most actionable thing on this list.
🔬 Cursor Disclosed the Benchmark Leak. The Post Got Twenty Hacker News Points.
The most important paragraph published this week got two comments
On July 8, Cursor and SpaceXAI released Grok 4.5. It is priced at $2 per million input tokens and $6 per million output, with a fast variant at $4 and $18, and it ships inside Cursor as a first-party model. Cursor’s post is worth reading slowly, because it contains two sentences that almost nobody has connected.
The first: “Grok 4.5 is a mixture-of-experts model that we trained jointly with SpaceXAI.” Cursor did not integrate this model. Cursor helped build it.
The second, and it is doing a lot of work: “Training included trillions of tokens of Cursor data which capture a wide-range of user interactions with codebases and software tools… capturing how developers work and how agents interact with their environments.”
Then, in a footnote under the benchmark chart:
“Grok 4.5 has an advantage on CursorBench because an earlier snapshot of the Cursor codebase was accidentally included in training. The exact impact is unclear. That data has been removed for future models, and in parallel we are working on a larger update to CursorBench, hence the exclusion here.”
Be precise about what that says, because it is narrower than the headlines would make it and still bad. Cursor is not saying the benchmark’s tasks or answers were in the training set. It is saying the private codebase that CursorBench’s tasks are drawn from, the one a Cursor engineer publicly described as held out from training, was not held out. The benchmark stopped being a clean-room measurement, and Cursor cannot say by how much.
And they volunteered it. Give them real credit for that. Almost nobody else would have.
And then almost nobody engaged with it. SpaceXAI’s launch post took 774 points on Hacker News. Cursor’s post, the one with the disclosure in it, took 20 points and 2 comments. SpaceXAI’s own announcement does not mention it at all. We went looking for coverage and found none: no TechCrunch, no Verge, no Ars. As far as we can tell, the disclosure lives on exactly one page, written by the disclosing party.
The part that should actually bother you
Grok 4.5 does not top CursorBench. It sits fourth, at 66.7%, behind Fable 5 Max at 70.5%. So this is not a stolen crown.
Look at what the contaminated score is propping up. On Cursor’s headline chart, Grok 4.5 lands at roughly $1.51 per task against $17.32 for the model that beats it. It is not the best. It is the one that looks like a frontier model at a tenth of the price, which is the single most commercially valuable position on that page. And that score is still on the leaderboard as of this morning. “Hence the exclusion here” meant excluded from the blog post’s comparison, not removed from the board. Cursor’s own changelog on that page shows the leaderboard was revised on July 9, the day after the disclosure. The score is still there.
Six days before the disclosure, a Cursor engineer wrote on Hacker News that “CursorBench includes many evals from actual engineering tasks from the Cursor team, which include our private codebase. This codebase is held-out from training so models haven’t seen it.” Six days later, Cursor said it wasn’t. That is not proof anyone lied. Accidents get discovered late, and that is the likeliest explanation. But it is a clean illustration of how little anyone, including the people building these systems, actually knows about what is in the training set.
And there is a policy edit worth putting on the record
Until June 9, 2026, Cursor’s data-use policy contained this sentence: “None of your code will ever be trained on by us or any third-party.” You do not have to take our word for it. It is right there in the archived version from June 3, alongside a Privacy Mode (Legacy) tier promising that “none of your code will ever be stored or trained on by us or any third-party.”
On June 9, both were deleted. What replaced it is narrower: Privacy Mode now means “Customer Data will not be used for training by Cursor,” with carve-outs for abuse classifiers and non-ZDR models. And with Privacy Mode off, the policy is explicit: “we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.”
Seven days after that edit, SpaceX announced its agreement to acquire Cursor for $60 billion. The deal is expected to close this quarter. It has not closed yet.
We are not telling you those two things are connected, because we cannot show that. We are telling you the dates, in order, and you can think whatever you think. What we can say plainly is that “train our models” now includes a frontier model co-built with the company that has agreed to buy them, and a developer who read that policy in 2025 was not imagining that.
One more gap, and it is the one that nags. We could not find anywhere Cursor publishes the default Privacy Mode setting for individual accounts. Their docs confirm it is on by default for Enterprise teams, and warn admins to watch out for personal accounts “which might not have Privacy Mode enabled.” When a user asked directly on Cursor’s own forum what the default is for Free and Pro, the question went unanswered. And the launch post never says which customers, plans, or consent states supplied those trillions of tokens.
Why it matters: Two lessons, and the second is the expensive one.
Run your own evals. Cursor owns the code, owns the benchmark, co-trained the model, and the most they could tell you is that “the exact impact is unclear.” If the party with maximum visibility cannot quantify their own contamination, a public leaderboard you did not build tells you nothing about your repo. This is the same conclusion Databricks reached from the opposite direction, in the same week, which is why they built their benchmark on private PRs.
And read the data-use page of every tool your code passes through, not once, but when the company changes hands. Zero-data-retention was a procurement checkbox for a lot of teams. Checkboxes are contractual, and contracts get rewritten seven days before an acquisition.
Hype vs. Reality: 5/10. No villain, no smoking gun, and Grok 4.5 loses four of the five third-party benchmarks in its own launch post. The disclosure was real and voluntary and they deserve credit for it. The structural fact underneath it is the story, and it is worse than any scandal: the people who built the model, own the benchmark, and wrote the policy still cannot tell you what went in.
💰 The Floor Fell Out, and the Supplier Started Eyeing the Tap
Cheap models are now a supply-chain question
The pricing news came fast this week. Meta opened the Meta Model API in US public preview with Muse Spark 1.1, a model that “can actively manage its context window of 1 million tokens,” at a reported $1.25 in and $4.25 out. Note it is a preview, US-only, and not GA. And note the trap that ties straight back to Databricks: it is a reasoning model, and chain-of-thought tokens bill at the full output rate. The sticker price is not the price.
Tencent released Hunyuan Hy3, a 295B mixture-of-experts model that only lights up 21B active parameters per token, with a 256K context, under Apache 2.0. The specs are good. The license is the story, and trade coverage flagged what Tencent’s own announcement does not mention: April’s preview shipped under a restrictive license that excluded the EU, the UK and South Korea, and the current release carries none of that. If you are a European team that had to skip Hy3 in April on license grounds, the license is no longer the blocker. Nobody sent you a memo about it.
Then the two stories that actually matter, sitting right next to each other.
CNBC found, using OpenRouter data, that Chinese-origin models have taken at least 30% of routed token volume every single week since February, peaking at 46%. DeepSeek alone is 17.6%. A year ago that number was 4.5%.
Be careful how you read that, because most coverage is not being careful. OpenRouter is a routing marketplace skewed toward indie developers and startups. It is not a mirror of US enterprise AI spend, most of which goes direct through Azure, Bedrock, and first-party contracts that never touch a router. “46% of tokens on OpenRouter” and “46% of American enterprise AI” are very different sentences. But the trend is real, it is steep, and it is price-driven.
And then, four days into that story, Reuters reported that Beijing has been holding meetings with Alibaba, ByteDance and Z.ai about curbing overseas access to China’s top AI models, including unreleased ones. A summary in an official Supreme People’s Court journal describes a proposed tiered system where the most sensitive frontier models would be barred from public release or restricted to domestic use.
Nothing has been proposed publicly. No agency commented. This is exploratory, and you should not read a policy into it. But look at who was in the room: Z.ai, the maker of GLM 5.2. The model that anchors every “the margins are collapsing” argument, including Martin Alderson’s essay that took 691 points this week, arguing that frontier inference runs at something like 90% gross margin (his words: “napkin maths,” and “probably”) and that GLM 5.2 undercuts it at “less than 20% of the retail price of Opus.”
His sharpest point is the one to keep: “Both Z.ai and Fireworks offer both an OpenAI compatible and Anthropic compatible endpoint.” At the API level, switching is close to a base-URL and model-name change. That is not the same as behavioral portability, which still needs testing, but the integration moat most vendors are counting on is thinner than they would like.
Why it matters: The cheap-inference arbitrage is real and it is available right now. But the thing that makes it frictionless, an OpenAI-compatible endpoint you can point at with one config change, is exactly the thing that makes it a dependency. If a third of your tokens run through models whose government is in meetings about restricting foreign access, that is not a pricing decision anymore. That is a supply chain with a single point of failure, and you should know your fallback path before you need it.
Hype vs. Reality: 6/10. The prices are real. The Beijing story is a set of meetings, not a rule. Treat it as a risk to plan for, not a thing that happened.
🛂 Illinois Made an Outside Auditor Check the Frontier Labs’ Homework
And both OpenAI and Anthropic backed it
On July 6, hours after last week’s issue hit your inbox, Governor Pritzker signed Illinois SB 315 into law. It is now Public Act 104-0538, and it makes Illinois the first state in the nation to require regular independent third-party safety audits of frontier AI systems.
Be precise about what the auditor actually certifies, because it is narrower than the headline suggests: not that a model is safe, but that the developer complied with the statute. Its frameworks, internal controls, disclosures, and incident processes. That is still a first, and it is still a real burden. California and New York stop at transparency: publish your framework, report your incidents. Illinois puts an outside party in the loop to check that you did.
Get the dates right, because they are the part everyone is already garbling: the Act takes effect January 1, 2027, and the audit requirement does not bite until January 1, 2028.
The mechanics: it covers developers with over $500M in annual revenue and models trained above 10^26 FLOPs (it is an AND, not an OR). Critical safety incidents must be reported within 72 hours, dropping to 24 hours if there is imminent risk of death or serious injury. Penalties run to $1M per violation and $3M for repeats. Enforcement belongs exclusively to the Illinois Attorney General, and there is no private right of action, which meaningfully limits the teeth.
It passed the Senate 52 to 5 and the House 110 to nothing. Both OpenAI and Anthropic supported it.
Why it matters: Almost every reader is below the threshold, so this does not regulate you directly. It regulates the labs upstream of you. Our expectation, and we will flag it as a prediction rather than a requirement of the Act, is that it flows downhill as vendor paperwork: risk classifications, incident-reporting obligations, evidence requests your model provider needs in order to satisfy their own auditor. Nothing in the statute obliges you to produce any of that. It obliges them, and vendors do not absorb compliance burden quietly. Start keeping receipts on how you deploy frontier models before someone asks you for them in 2028.
Hype vs. Reality: 3/10. A signed statute with a public act number, a hard effective date, and unanimous House support. Nothing to hype. Just true.
💬 UPDATE: The Guest List Opened
GPT-5.6 went GA, and the gate that held it is still there
In issue #020 we covered OpenAI holding GPT-5.6 back to roughly 20 partner organizations, at the government’s request, with the partner list shared with federal officials. That gate opened on July 9. GPT-5.6 (Sol, Terra, Luna) is now generally available across ChatGPT, Codex and the API, at $5/$30, $2.50/$15 and $1/$6 per million tokens respectively.
Commerce’s Center for AI Standards and Innovation ran additional testing, and after about 12 days OpenAI proceeded to general availability. Here is the nuance worth carrying: Executive Order 14409 is explicitly voluntary. Developers “may” give the government up to 30 days of pre-release access, and the order goes out of its way to say that nothing in it authorizes “a mandatory governmental licensing, preclearance, or permitting requirement.” Thirty days is a ceiling, not a waiting period. The review finished early.
And yet. OpenAI shipped to 20 partners instead of the public, because the government asked. Critics have started calling it a de facto involuntary licensing regime, and OpenAI itself is not comfortable: “We don’t believe this kind of government access process should become the long-term default. It keeps the best tools from users, developers, enterprises, cyber defenders, and global partners who need them.”
Why it matters: Voluntary on paper, a gate in practice. That is our read, not a legal finding, and it is the same permission layer we flagged in #020 and #021. It did not go away when the model shipped. It just moved fast this time, which is the best case, and the best case is still a case where a company held a finished product because Washington asked.
🎯 The Playbook
Your move this week
- Measure your context-per-turn before you switch models. The Databricks result says a harness swap can cut your agent bill by more than half at identical quality, with no vendor change. That is the cheapest win available to you right now, and it is sitting in your own telemetry.
- Stop budgeting on per-token price. Sonnet 5 is 1.7x cheaper per token than Opus 4.8 and cost more per task, while completing fewer of them. Price your agents per completed task or you are flying blind.
- Build your own eval on your own repo. Cursor co-built a model, owns the benchmark, and could still only tell you “the exact impact is unclear.” If the party with maximum visibility cannot quantify their own contamination, a leaderboard you did not build is not going to.
- Re-read the data-use page of every tool your code passes through, especially anything with a pending acquisition. Zero-data-retention is a contract, not a law of physics, and contracts get rewritten. Cursor’s got rewritten seven days before a $60 billion deal was announced.
- Ask what your conformance suite actually proves. Kelley’s paradox is free consulting. If you would trust your tests to validate an agent-written rewrite, ask why they were not catching your bugs already. One of those beliefs is wrong.
- Audit your agent’s read scope, not its prompt. Every disclosure below is a permissions bug wearing a prompt-injection costume. If your agent can read untrusted input and reach anything sensitive, no system prompt saves you.
🔥 What’s Viral Right Now
Terence Tao ported his 1999 Java applets with a coding agent. Two dozen or so applets, done in hours instead of months. He found exactly one minor bug in the ported code, and the agent found two bugs in his original 1999 code, which he calls “a net wash.” The real lesson is his risk calculus, and it is the sanest sentence written about agents this week: the applets are “secondary visual aids rather than critical components of a mathematical argument,” so “the downside risk of such bugs is relatively low.” Match agent autonomy to blast radius. That is the whole skill.
Colibri runs the 744B GLM-5.2 on a 25GB laptop. Pure C, zero dependencies, streaming cold experts off SSD because a sparse MoE only activates a fraction of its weights per token. It took 904 points on Hacker News. It also runs at 0.05 to 0.1 tokens per second, which is minutes per paragraph, and the README says so honestly. Beautiful idea, useless artifact, and the architectural insight (RAM is a speed dial, not a wall) is worth more than the binary.
npm v12 disabled dependency lifecycle scripts by default. Postinstall scripts and implicit node-gyp builds no longer run unless you allowlist them, and Git and remote-tarball dependencies are refused unless you opt in. If your CI leans on any of those, and it probably does somewhere (native modules, Playwright browser fetches, Husky), it is going to break on upgrade. That is not a bug, that is two years of supply-chain lessons finally becoming a default. Go commit an allowlist.
OpenAI shipped GPT-Live. Full-duplex voice that listens and speaks at the same time, with deep reasoning delegated to a background model so the conversation never stalls. The architecture is the interesting part and it generalizes to any interruptible interface. Developer API is still “coming soon,” so this is directional, not something you can build on yet.
🛡️ On Your Radar: Five Exploits, and One That Just Ships That Way
The researchers had to work for it. The last one is default behavior.
This is the densest week of agent-security research we have covered, and the pattern is not subtle. Prompt injection supplies the steering. Permissions supply the blast radius. You cannot patch the first one away, so the leverage is all in the second.
GitLost (Noma, July 6). If your org runs a GitHub Agentic Workflow that processes issue content and holds cross-repository read access, an unauthenticated stranger with no code and no access can open an issue on any public repo in that org. The agent reads it, then reads your private repos, then posts their contents as a public comment. The guardrail bypass is the most humbling detail in AI security this year: prefixing the malicious instruction with the word “Additionally” made the model treat it as a follow-on task instead of something to refuse. There is no CVE and no public confirmation of a fix.
GhostApproval (Wiz, July 8). A repo ships a symlink. The agent follows it on write. The approval dialog shows you the harmless filename while the agent writes to ~/.ssh/authorized_keys. Six assistants affected, with two real CVEs: CVE-2026-50549 (Cursor, CVSS 9.8, fixed in v3.0) and CVE-2026-12958 (Amazon, fixed in 1.69.0). Augment and Windsurf were still unpatched at disclosure. Anthropic disputed the finding as outside its threat model, arguing that a user who trusts a directory owns the approval decision, though in fairness Claude Code had already shipped symlink warnings back in February, before the report even landed. The lesson stands regardless: the human-in-the-loop control you rely on is the thing that lied to you. Resolve symlinks before you render the approval, or your consent is uninformed by construction.
Friendly Fire (AI Now Institute, July 8). This one is genuinely nasty. Pointing a coding agent at a sketchy dependency and asking “is this safe?” is the single most-recommended defensive use of these tools. It is also the exploit. Injections scattered through the library’s source convince the reviewing agent that running an attacker-supplied binary is a necessary part of the security review. It works out of the box on Claude Code auto-mode and Codex auto-review, with no hooks, skills, plugins, MCP servers or config files needed, and it transferred between the two unchanged. There is no CVE, and the authors argue there cannot be a patch: “these flaws cannot be remediated at the model level.”
HalluSquatting (Tel Aviv University, Technion and Intuit, July 8). Slopsquatting means registering a package name and waiting for a model to hallucinate it. This is worse. A universal, transferable adversarial trigger forces the agent to hallucinate an attacker’s chosen repo or skill, which the attacker has pre-registered. Hit rates run up to 85% for repository cloning and up to 100% for skill installation, across Cursor, Windsurf, GitHub Copilot Chat, Cline and Gemini CLI, and the triggers transfer between models. Hallucination stops being a nuisance and becomes a steerable delivery mechanism. Agent marketplaces are the soft target.
Ghostcommit (ASSET Research Group, this week). The payload is rendered as text inside a PNG. A benign-looking AGENTS.md tells the agent to read a build constant from the image. Your AI reviewer never opens it, because CodeRabbit’s default config excludes *.png outright and Bugbot returned no findings, so the PR merges clean. Days later, in an unrelated session, a vision-capable agent follows the pointer, opens .env, and writes your secrets into production code as a tuple of 311 integers. Cursor and Antigravity both leaked. Claude Code refused, under every model tested. The supporting number is the one that should actually scare you: across 6,480 pull requests in the 300 most active public repos over 90 days, 73% reached the default branch with no substantive human review and no bot review at all.
Now the sixth one, which is not an exploit at all.
Nobody had to attack Grok Build. It uploads your repo by itself.
On July 12, an independent researcher published a wire-level teardown of xAI’s Grok Build CLI (version 0.2.93, binary hash published, full reproduction repo included). It went to 470 points on Hacker News. The claims, captured with mitmproxy on the researcher’s own machine using fake canary secrets:
A .env file the agent reads gets transmitted to xAI verbatim and unredacted. And separately, independent of anything the agent reads, the CLI uploads your entire repository, every tracked file plus full git history, as a git bundle to a named Google Cloud Storage bucket called grok-code-session-traces. Not streamed through the model to answer your question. Uploaded to object storage.
The demonstration is the part that is hard to wave away. Given the prompt “Reply with exactly: OK. Do not read or open any files,” the CLI uploaded the repo anyway. The researcher then ran git clone on the captured bundle and recovered a planted file the agent had been explicitly told not to open, marker intact, along with the complete commit history. Replicated on a second, unrelated repo. On a 12GB test repo the storage channel moved 5.1GB while the model channel moved 192KB, a ratio of roughly 27,800 to 1, which means the bytes were not going to the model. They were going to the bucket.
Turning off “Improve the model” did not stop it. The server kept returning trace_upload_enabled: true.
The upload machinery has a name inside the binary. Running strings on the shipped executable surfaces the Rust crate paths behind all of it:
crates/codegen/xai-data-collector/src/gcs.rs
crates/codegen/xai-data-collector/src/file_access_tracker.rs
crates/codegen/xai-data-collector/src/queue.rsThey called it xai-data-collector.
Steelman it, because it deserves one. Every cloud coding agent has to send your code somewhere to work on it. That is the job. The researcher concedes this directly, and is careful to say the analysis proves transmission and storage, not that xAI trains on any of it. He also retracted an earlier wrong conclusion in the same document, which is more intellectual honesty than most vendor postmortems manage.
The deltas that survive the steelman: a secrets file sent unredacted, the whole repo persisted to a named bucket rather than processed in flight, on by default, and an opt-out that does not opt you out.
As of this morning we found no public response from xAI. We have not reproduced this ourselves, and it is one researcher’s analysis of one version of one binary. Treat it as a well-evidenced claim rather than a settled fact, and go read the method yourself, because he published it. But if you have Grok Build pointed at a private repo right now, that is a decision worth making on purpose.
Why it matters: For the five disclosures above, say the honest thing: every one is researcher proof-of-concept work, and we found no public evidence of any of them being exploited in the wild. Absence of evidence, not proof of absence, but anyone selling you panic this week is selling you something.
The sixth is the one to sit with, because it is not a vulnerability. Nobody had to bypass a guardrail or hide a payload in a PNG. It is a shipping product doing exactly what it was built to do, and the researcher’s own framing is the right one: the question was never whether the tool could be made to leak. It was what it does when nobody is attacking it at all.
The defense did arrive in the same week, at least. CodeQL 2.26.0 added a js/system-prompt-injection query, the first mainstream static analyzer to treat “untrusted input reaches the system prompt” as a first-class taint sink. And Claude Code shipped a rule forbidding the agent from tampering with its own session transcript, which, if you followed last week’s issue on coding agents faking their homework, is a quietly remarkable admission: the agent’s own log is now an attack surface.
Your agent’s context window is your attack surface. Everything it can read is instruction input, everything it can reach is blast radius, and everything it can phone home to is somebody else’s disk. Audit the permission grant, not the prompt. Then audit the network.
Bun disclosed this week that up to 64 concurrent agents produced a million-line Rust port over 11 days in May, and that the only thing standing between that diff and a release is a test suite nobody has audited. The tooling to run fleets is here, the economics are better than you think, and the verification story is worse than anyone wants to admit.
Notice what all of it has in common. Bun cannot tell you whether a million lines are correct, only that the tests pass. Cursor cannot tell you how much its own codebase moved its own benchmark, only that “the exact impact is unclear.” And a lot of builders running Grok Build this morning cannot tell you their repository already left the building.
The bottleneck was never writing the code. It was knowing what is true about it. That part still has not been automated, and this week, at least, the internet noticed.
Stay building. 🛠️
— Matt