{
  "Event": {
    "uuid": "70ad5698-0100-4872-81ad-beea71ae3f0a",
    "info": "Grok Build CLI shipped entire repos to xAI — Optimus Labs · Civilizations",
    "date": "2026-07-16",
    "threat_level_id": "1",
    "analysis": "2",
    "published": true,
    "Orgc": {
      "name": "Optimus Labs · Civilizations"
    },
    "Tag": [
      {
        "name": "optimus:briefing=\"grok-build-repo-exfiltration\""
      },
      {
        "name": "optimus:severity=\"critical\""
      },
      {
        "name": "optimus:type=\"coding-agent\""
      },
      {
        "name": "optimus:type=\"rogue-ai\""
      },
      {
        "name": "optimus:type=\"supply-chain\""
      },
      {
        "name": "optimus:category=\"AI\""
      },
      {
        "name": "optimus:category=\"AL\""
      },
      {
        "name": "optimus:category=\"AP\""
      },
      {
        "name": "optimus:category=\"OL\""
      },
      {
        "name": "type:OSINT"
      }
    ],
    "Attribute": [
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration",
        "comment": "Optimus Labs briefing"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.linkedin.com/posts/guptanipun_my-spare-laptop-ran-completely-out-of-disk-share-7482518573358264320-gt",
        "comment": "Optimus Labs — discovery write-up (LinkedIn)"
      },
      {
        "type": "filename",
        "category": "Payload delivery",
        "to_ids": false,
        "value": "grok/config.toml",
        "comment": "~/.grok/config.toml — check for [harness] disable_codebase_upload and [telemetry] trace_upload"
      }
    ]
  }
}