{"version":"1.0","generated_at":"2026-10-04T19:28:29.015835","id":1776,"slug":"xai-grok-cli","title":"xAI 官方 Grok CLI 被曝静默上传整个代码库及用户密钥","summary":"xAI官方Grok CLI被曝默认静默上传用户代码库及密钥，xAI随后远程关闭该功能。","abstract":"xAI 官方 Grok CLI 被曝静默上传整个代码库及用户密钥 xAI官方Grok CLI被曝默认静默上传用户代码库及密钥，xAI随后远程关闭该功能。 xAI官方Grok CLI被曝默认静默上传用户代码库及密钥，xAI随后远程关闭该功能。 原贴提到：安全研究者发现，xAI 官方 Grok CLI（npm 包 `@xai-official/grok` 0.2.93 版）会在每轮任务前后，将当前 来源：mp.weixin.qq.com 安全研究者发现，xAI 官方 Grok CLI（npm 包 @xai-official/grok 0.2.93 版）会在每轮任务前后，将当前工作目录打包为 before_codebase.tar.gz 和 after_codebase.tar.gz ，通过独立旁路通道静默上传至 xAI 的 Google Cloud 仓库。验证显示，即使模型仅回复一个单词，上传依然发生。上传包还包含仓库外的 ~/.claude.json 、Claude Code 设置、全局 AGENTS 规则、30 多个 Skill 文件及一个 API 密钥。7 月 13 日凌晨，xAI 通过服务端远程开关新增 disable_codebase_upload 字段，将默认上传行为关闭，但此前该功能默认开启。 这是什么信号 ：xAI官方CLI工具在未经用户明确同意的情况下，静默上传整个工作目录及配置文件，暴露出AI工具在安全合规方面的严重缺陷。这不仅是xAI的个案，更反映了当前AI开发工具普遍存在的数据隐私隐患。 为什么重要 ：开发者在使用AI辅助编码时，往往信任官方工具不会滥用权…","access_level":"member","access_label":"免费阅读","access_mode":"full","is_preview":false,"canonical_url":"https://opc.beizhux.com/content/1776/xai-grok-cli","html_url":"https://opc.beizhux.com/content/1776/xai-grok-cli","json_url":"https://opc.beizhux.com/content/1776/xai-grok-cli.json","published_at":"2026-07-13T08:05:00","updated_at":"2026-10-04T18:49:08","category":{"slug":"ai-business","name":"AI小生意项目库"},"source":{"site":"mp.weixin.qq.com","author":"公众号：数字生命卡兹克","url":"https://mp.weixin.qq.com/s/6c6vGMJAVMbh6UhNVw4dcg"},"tags":["AI","AIHOT 精选","AI安全","AI工具","API密钥","CLI","CLI工具","Grok","Grok CLI","npm","npm包安全","xAI"],"topics":[{"slug":"ai-side-business","name":"AI副业","url":"https://opc.beizhux.com/topics/ai-side-business","reason":"这篇内容命中「项目、小生意、变现」等主题信号。"},{"slug":"ai-tools","name":"AI工具","url":"https://opc.beizhux.com/topics/ai-tools","reason":"这篇内容命中「AI工具、工具、自动化」等主题信号。"},{"slug":"ai-content-growth","name":"AI内容增长","url":"https://opc.beizhux.com/topics/ai-content-growth","reason":"这篇内容命中「公众号」等主题信号。"}],"keywords":["AI小生意项目库","AI副业","AI工具","AI内容增长","工具","自动化","模型","Cursor","Claude","Agent","工作流","Claude Code"],"questions":[{"question":"xAI 官方 Grok CLI 被曝静默上传整个代码库及用户密钥主要讲什么？","answer":"xAI官方Grok CLI被曝默认静默上传用户代码库及密钥，xAI随后远程关闭该功能。"},{"question":"这篇文章最值得关注的要点是什么？","answer":"xAI官方Grok CLI被曝默认静默上传用户代码库及密钥，xAI随后远程关闭该功能。；原贴提到：安全研究者发现，xAI 官方 Grok CLI（npm 包 `@xai-official/grok` 0.2.93 版）会在每轮任务前后，将当前；来源：mp.weixin.qq.com"},{"question":"这篇文章和哪些AI专题相关？","answer":"它适合放在AI副业、AI工具、AI内容增长专题里阅读。 关联原因：这篇内容命中「项目、小生意、变现」等主题信号。；这篇内容命中「AI工具、工具、自动化」等主题信号。；这篇内容命中「公众号」等主题信号。"},{"question":"阅读这篇文章建议先理解哪些关键词？","answer":"建议先理解AI工具、工具、自动化、模型、Cursor这些关键词，再结合正文判断工具、机会或风险是否值得进入自己的工作流。"}],"terms":[{"slug":"ai-tools-term","name":"AI工具","definition":"在AI觉醒星球里，「AI工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/ai-tools-term","path":"/glossary/ai-tools-term","json_url":"https://opc.beizhux.com/glossary/ai-tools-term.json"},{"slug":"tools","name":"工具","definition":"在AI觉醒星球里，「工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/tools","path":"/glossary/tools","json_url":"https://opc.beizhux.com/glossary/tools.json"},{"slug":"automation","name":"自动化","definition":"在AI觉醒星球里，「自动化」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/automation","path":"/glossary/automation","json_url":"https://opc.beizhux.com/glossary/automation.json"},{"slug":"ai-model","name":"模型","definition":"在AI觉醒星球里，「模型」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/ai-model","path":"/glossary/ai-model","json_url":"https://opc.beizhux.com/glossary/ai-model.json"},{"slug":"cursor","name":"Cursor","definition":"在AI觉醒星球里，「Cursor」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/cursor","path":"/glossary/cursor","json_url":"https://opc.beizhux.com/glossary/cursor.json"},{"slug":"claude","name":"Claude","definition":"在AI觉醒星球里，「Claude」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/claude","path":"/glossary/claude","json_url":"https://opc.beizhux.com/glossary/claude.json"},{"slug":"agent","name":"Agent","definition":"在AI觉醒星球里，「Agent」属于「Agent工作流」方向。聚合Agent、AI编程、Claude Code、Cursor、工作流自动化等内容，帮助你把智能体能力落到真实任务链路。 把智能体当成任务系统，而不是聊天窗口。","topic_slug":"agent-workflow","topic_name":"Agent工作流","topic_title":"Agent工作流：智能体、AI编程与自动化协作","topic_url":"https://opc.beizhux.com/topics/agent-workflow","topic_path":"/topics/agent-workflow","url":"https://opc.beizhux.com/glossary/agent","path":"/glossary/agent","json_url":"https://opc.beizhux.com/glossary/agent.json"},{"slug":"workflow","name":"工作流","definition":"在AI觉醒星球里，「工作流」属于「Agent工作流」方向。聚合Agent、AI编程、Claude Code、Cursor、工作流自动化等内容，帮助你把智能体能力落到真实任务链路。 把智能体当成任务系统，而不是聊天窗口。","topic_slug":"agent-workflow","topic_name":"Agent工作流","topic_title":"Agent工作流：智能体、AI编程与自动化协作","topic_url":"https://opc.beizhux.com/topics/agent-workflow","topic_path":"/topics/agent-workflow","url":"https://opc.beizhux.com/glossary/workflow","path":"/glossary/workflow","json_url":"https://opc.beizhux.com/glossary/workflow.json"}],"preview_hidden_sections":[],"related_items":[{"id":3223,"title":"美财长贝森特批评 Anthropic、OpenAI 等风险警告：危言耸听、光喊话不拿解决方案","url":"https://opc.beizhux.com/content/3223/anthropic-openai","summary":"美国财政部长贝森特在 Axios 采访中点名批评 Anthropic CEO 阿莫代伊等人的 AI 生存性风险警告，认为只发出危言耸听的声音却拿不出解决方案不是领导力，并呼吁实验室负责人承担安全责任、安全地加速发展。","access_level":"member"},{"id":3224,"title":"BestBlogs 早报：VS Code 周更与递归语言模型等十则","url":"https://opc.beizhux.com/content/3224/bestblogs-vs-code","summary":"BestBlogs 早报汇总十则 AI 动态，其中三条值得单独拎出：VS Code 团队把发布节奏从月更改为周更，代码存活率由 55% 升至 86%；Google DeepMind 的 Interactions API 用交互标识保存上下文与思维签名，并以环境标识复用托管智能体沙箱；DatologyAI 把预训练合成…","access_level":"member"},{"id":3226,"title":"AI 用 5 天生成《辐射：纽约》浏览器游戏，被贝塞斯达发函叫停","url":"https://opc.beizhux.com/content/3226/ai-5-2","summary":"创作者 Chrisfirst 借助 Claude Opus 5.5 在五天内生成浏览器游戏《辐射：纽约》，因贝塞斯达发停止侵权函被叫停。该事件凸显 AI 降低游戏开发门槛与 IP 合规风险之间的冲突，可能影响头部游戏 IP 的玩家生态。","access_level":"member"}],"usage_policy":{"summarizable":true,"preferred_url":"https://opc.beizhux.com/content/1776/xai-grok-cli","private_fields_excluded":true}}