xAI’s Grok Build uploaded your entire repository

A security researcher at CerebLabs published a wire-level analysis on July 12 that proved xAI’s Grok Build CLI had been packaging developers’ entire git repositories, full commit history, all tracked files, and shipping them to a Google Cloud Storage bucket controlled by xAI through a separate channel from the model-turn stream. Not just the files a coding task needed to read. The entire repository.

The mechanism is specific. On a 12 GB test repository, Grok Build’s model-turn channel at /v1/responses moved approximately 192 KB: the actual coding context. A parallel storage channel at /v1/storage moved 5.10 gigabytes in 73 chunks of roughly 75 MB each. The ratio between what the model needed and what left the machine was approximately 27,800 to one. A tracked .env file containing canary API_KEY and DB_PASSWORD values went with it, unredacted.

The blast radius covers every developer who ran Grok Build CLI version 0.2.93 against any git repository that had committed credentials, configuration secrets, or proprietary code. This is not a theoretical exposure. The data moved to a cloud bucket xAI controls. The /privacy toggle, the setting that tells xAI not to retain your data, operated only on post-session retention. It had no effect on what left your machine during the session. The control did not do what the label implied.

The pattern is not new, but the stakes are high. AI coding tools see more sensitive material than almost any other product category: API keys, database schemas, internal service URLs, committed secrets that engineers meant to clean up later. The gap between “this tool reads the files you point it at” and “this tool ships your entire repository to our storage” is wide. Discovering that gap from a wire-level audit, not from a vendor disclosure, is the worst possible way to find it.

The response was silent. On July 13, the day after the researcher published, the same 0.2.93 binary stopped making storage requests. The server began returning disable_codebase_upload: true. xAI issued no statement, posted no announcement, sent no notification to affected users. The analysis hit the front page of Hacker News on July 14. Elon Musk, in a post on X, promised deletion of all previously uploaded user data.

Claude for Teachers

Anthropic on Monday launched Claude for Teachers, offering verified K-12 educators in the United States free access to premium Claude capabilities through June 30, 2027. The product includes Claude Code and Cowork, access to evidence-based curricula mapped to academic standards across all 50 states, and the ability to schedule recurring tasks: reviewing exit tickets at 4 PM each school day, adapting the next lesson plan based on what the class understood today.

The collaboration with the American Federation of Teachers is notable for who Anthropic went to first. Union before district administration. Teachers before procurement officers. The AFT represents 1.7 million members; getting the union’s backing shapes distribution and trust in a way that a district-level deal does not.

Training is off for verified teacher accounts. Anthropic said this explicitly in the announcement. That sentence is doing meaningful work today given everything else on the wire: it is the structural opposite of what xAI’s privacy toggle was implying while doing something different. One lab launched a product with privacy as the headline feature. Another silently patched a tool that had been exfiltrating codebases for weeks.

The blast radius covers approximately 3.7 million public school teachers in the United States who have been priced out of or locked out of enterprise AI products. Free full-year access, verified through an individual signup, no institutional procurement required. Claude for Teachers joins Google, OpenAI, and Khan Academy in targeting K-12 educators directly. The difference is the AFT partnership and the depth on curriculum and scheduling work.

Artifacts go multiplayer, live in Slack

Claude now supports public sharing of Artifacts (no Claude account required to view a shared link), collaborative editing by multiple team members within a single Artifact, and creation of Artifacts directly from Slack via Claude Tag. Microsoft 365 integration is also shipping this week.

The mechanism: Claude Tag lets you summon Claude with @Claude in any Slack channel, where it carries shared organizational context and tool access. Claude can automatically create a persistent Artifact from the discussion. The Artifact is then editable by the team and shareable publicly via link. Admins retain control over who can access what through organization-wide settings.

The read: Anthropic is building toward Claude as the production layer for team deliverables, not just a chat interface. Artifacts that live outside the conversation, are editable by the team, and are publicly shareable without a login requirement are a different product category. It is a lightweight document and publishing layer with AI at the center. Microsoft 365 integration puts it inside both halves of enterprise communication.

Hassabis wants a FINRA for frontier AI

Google DeepMind CEO Demis Hassabis published a manifesto on July 14 calling for the United States to establish a regulatory body for frontier AI models, modeled specifically on FINRA, the financial industry’s self-regulatory organization. The body would test advanced models for dangerous capabilities: cyber, biological, deception. It would have authority to coordinate an industry-wide slowdown if threat levels mount. Hassabis told Axios he wants the body operational within months, ideally before the end of 2026, and described early conversations with the Trump administration as yielding positive signals.

The structure of the proposal is precise. FINRA is self-regulatory in the sense that the industry funds and participates in it, but it carries binding authority over member behavior. The AI equivalent Hassabis describes is a two-step test-then-gate model: an independent body tests for dangerous capabilities as models approach release. If a model crosses a threshold, the body can require a coordinated slowdown across all participating labs simultaneously. This matters because it avoids the competitive asymmetry of unilateral pauses: one lab slowing down while competitors do not is a bet that costs billions. A coordinated pause costs everyone the same amount, so it can be enforced without defection.

Hassabis has publicly placed AGI at 2030 plus or minus a year. The manifesto and the timeline are not coincidental. He is proposing the institution before he believes the hardest moment arrives.

The cross-lab read: Hassabis published this on the same day xAI silently patched a product that had been exfiltrating developer codebases without consent, and roughly three days after Meta pulled an AI image feature that had auto-enrolled users into something they did not know about. The proposal addresses the model-capability tier of risk. The product-behavior tier, where the violations are quieter and the blast radius is everyone who ran your CLI last week, has no proposed solution on the table today. No one has yet proposed a FINRA for AI product behavior, only for AI model capabilities.

Gemini 3.5 Pro pushed to July 17 after a full rebuild

Google DeepMind pushed the Gemini 3.5 Pro release to July 17, following a decision to scrap the 2.5 Pro architecture entirely and rebuild from scratch. Engineers found structural failures in recursive tool-calling and SVG generation. The rebuilt model carries a 2 million token context window and a new Deep Think Reasoning Layer.

Scrapping a pre-training run at the frontier is not a routine engineering decision. The cost is in the hundreds of millions of dollars and months of development time. The decision to announce the rebuild publicly, rather than quietly shipping a model with known weaknesses, is itself a communication choice. Google is betting on a clean July 17 launch rather than a launch-and-patch cycle.

The pattern: Gemini went through the 2.0 to 2.5 transition with visible benchmark gaps that OpenAI and Anthropic pressed. Rebuilding rather than incrementing is an acknowledgment that an incremental 3.5 Pro would not close the gap with GPT-5.6 Sol and Fable 5. Three days from now will confirm whether the rebuild actually delivered what the press release promises.

Meta pulls Muse Image after Instagram users discovered they were in it

Meta launched Muse Image on Instagram as an AI photo generation tool. It automatically opted in every public account: every user’s photos could be referenced by anyone generating an image, with no notification to the person whose photos were used. SAG-AFTRA, talent agency CAA, and actors including Hannah Einbinder pushed back publicly. Meta pulled the feature from Instagram within days, admitting they “missed the mark.” Muse Image remains live in the Meta AI app and WhatsApp; only the Instagram surface is gone.

The mechanism of failure is structurally identical to xAI’s Grok Build: a system behaved in a way that exceeded what users understood they had consented to, and the correction came after discovery under public pressure, not before deployment. Meta’s team knew the feature auto-enrolled users. It shipped anyway. “Missed the mark” is what you say when the thing you shipped was not accidental.

The consent crisis is not an xAI problem

July 14 has a recurring structure across three labs. Systems handling user data behaved differently from what users were told or assumed. xAI’s Grok Build uploaded entire codebases while a privacy toggle addressed something else entirely. Meta’s Muse Image auto-enrolled every public Instagram account into AI image generation, allowing anyone to generate images using your photos, with no notification. Both were discovered after deployment. Both were corrected under public pressure. Both were framed, afterward, as misunderstandings.

The inference available to builders today: the stated privacy posture of an AI tool and its actual data handling are two different things, and they require independent verification. The researcher who caught Grok Build did not find it through documentation or privacy policies. They captured the network traffic. That is the verification mechanism that worked.

Hassabis is proposing a regulatory body for the model-capability tier of risk. The product-behavior tier, where an AI coding tool uploads your entire codebase while displaying a toggle that implies otherwise, has no proposed solution on the table. No one has yet proposed a mechanism for auditing that tier at scale. The CerebLabs researcher did it for one product, manually, once. That is not a system.

Claude Code v2.1.208

Anthropic shipped Claude Code v2.1.208 on July 14. New features: screen reader mode (opt-in via --ax-screen-reader flag or axScreenReader: true in settings), vim insert-mode remaps via the vimInsertModeRemaps setting (maps two-key sequences like jj to Escape), and CLAUDE_CODE_PROCESS_WRAPPER support for corporate launcher requirements. Mouse-click support added for multi-select menus in fullscreen mode.

The process wrapper addition is notable for enterprise deployments. Every Claude Code self-spawn now honors a required wrapper executable, which satisfies locked-down environments where all processes must route through a central audited launcher. This is the kind of feature that turns Claude Code from “blocked by IT” to “approvable” in enterprise contexts.

Bug fixes include: fast mode restoration after switching back to a model that supports it (was incorrectly staying off), /release-notes no longer injects the full changelog into model context (was inflating every subsequent request in the session), and memory leak patches for long sessions including MCP stdio server stderr accumulation and LSP documents staying open after file closure.