Digest · 9 stories · 18 sources
2026-07-12
Updated
Top stories
- What xAI's Grok Build CLI sends to xAI A researcher (cereblab) published a wire-level analysis dated 2026-07-10 of xAI's Grok Build CLI v0.2.93 using mitmproxy interception and planted canary files. The writeup claims the CLI transmits the contents of files it reads, including a .env secrets file, to xAI verbatim, and separately uploads the entire workspace as git bundles to a Google Cloud Storage bucket named grok-code-session-traces (POST /v1/storage) independent of what the agent reads. It reports a 12 GB repository produced about 5.10 GiB of storage uploads while model-channel traffic was only 192 KB, and that recovered bundles contained never-read files. It also cites telemetry to Mixpanel and an xAI events endpoint, and states the behavior runs by default regardless of privacy settings.
- Terence Tao ports two dozen math applets with coding agents Mathematician Terence Tao published a post on 2026-07-11 describing collaborative "vibe coding" sessions with LLM-based coding agents. He ported roughly 24 Java applets from around 1999 (including honeycomb and Besicovitch-set visualizers) to JavaScript, and built new interactive tools such as a special-relativity spacetime diagram and a Gilbreath-conjecture visualization tied to a recent paper. He reports finding only one minor bug across the two dozen ports, that the agent flagged two bugs in the original code, and that each new app took a couple of hours. He frames the downside risk as low because the applets are secondary visual aids, not core research, and labels the output alpha-quality LLM-generated code.
- Mesh LLM runs distributed inference over iroh Published 2026-07-11, Mesh LLM pools GPUs and memory across machines and exposes them as a single OpenAI-compatible endpoint. It uses iroh for authenticated, NAT-traversing QUIC connections between nodes (hole-punching and relay fallback, no central server), with three routing strategies: local execution, routing to a peer already running the model, or splitting a large model across machines in a pipeline-parallel "Skippy" mode where layer ranges become stages and activations flow sequentially. The protocol negotiates connection types over QUIC ALPN and demultiplexes streams with single-byte tags. The code is on GitHub.
- The case for SQLite STRICT tables A best-practice post argues for declaring SQLite tables STRICT so the engine rejects type mismatches (for example inserting text into an INTEGER column) instead of applying flexible type affinity. STRICT tables were added in SQLite 3.37.0 (November 2021). The ANY column type preserves flexible storage where needed. Caveats: converting an existing table needs a migration, STRICT is unavailable before 3.37.0, and the SQLite developers themselves favor flexible typing. This is guidance, not a new feature.