Grok Build CLI Sends Your Entire Repository to xAI — .env Files Exposed, Opt-Out Doesn't Help
An analysis of Grok Build CLI (v0.2.93) using mitmproxy revealed that **it sends the entire repository as a git bundle (complete history included) to xAI's Google Cloud**. Regardless of which files the user has open, all data gets uploaded.
Even more alarming: when the prompt explicitly instructed it "do not read files," the planted honeypot files could still be fully recovered from the transmitted data. `API_KEY` and `DB_PASSWORD` values in `.env` files were sent straight to `cli-chat-proxy.grok.com`.
Turning off the "Improve the model" toggle does not stop the uploads. That setting affects **model training** but has no bearing on **data upload**. Compared to competing tools like Claude Code and Cursor, this behavior is highly abnormal, and it has become a major talking point on privacy design in developer tools.
Soofi: Europe's Sovereign LLM Built in Just Two Months
A European project has announced that it built a sovereign LLM called "Soofi" in only two months. A technical report is publicly available on Hugging Face.
Europe has long been criticized for lagging behind in AI development due to GDPR and AI regulation. Soofi stands as a proof of concept that building an independent model in a short timeframe is possible by leveraging existing infrastructure and open research. It picked up 6 points on Hacker News, igniting a debate about European AI autonomy.
US Wariness of Chinese Open-Source AI Is Growing
According to Politico, the US tech industry holds **serious concerns** over the improving performance and increasing price competitiveness of Chinese open-source AI models. Whether the Trump administration will respond with further executive orders is the focal point.
The expanding market share of Chinese models such as DeepSeek and Qwen is a topic discussed daily in the LocalLLaMA community. The "US regulation vs. Chinese open source" framing is becoming an unavoidable geopolitical risk factor for AI developers around the world. Policy and the AI industry have grown so intertwined that on Wall Street, "which CEO has President Trump's ear" is now treated as an investment criterion.
The Fastest Speculative Decoding, Built for Qwen
trymirai has announced that it built **the fastest speculative decoding** for Qwen models. It is available as a fork of sglang, and the "Weaver" model is also published on Hugging Face.
Speculative decoding is a technique that dramatically improves inference speed by generating candidate tokens with a small model and verifying them with a large model. The Qwen series is highly popular in the local LLM community, and this optimization could deliver practical benefits to many developers. It currently only works with sglang, but support for their in-house engine uzu is planned.
EverFern: A Local, Open-Source Alternative to Claude Cowork
EverFern is an **open-source (MIT) desktop AI agent** built with LangGraph and Electron. It can execute computer control, browser automation, and file/code processing locally, offering an alternative that doesn't depend on cloud services costing $20–$200 per month.
In a test running Qwen3-8B locally, it managed multi-step tasks (opening a specific channel on YouTube, researching AI startups, etc.), although at the 8B class the planning accuracy was inconsistent and fell short of frontier-class reliability. It also ships with experimental features such as synthesizing tools at runtime and rolling back destructive commands. Improving agent reliability with local models is a challenge for the entire community, making this a project worth watching.
---