News for hackers. Stuff that matters.

A comment on Grok uploaded my user directory to xAI's servers. Parent comment

Re:Grok uploaded my user directory to xAI's servers by Izkata on Monday July 13, 2026 @11:14AM (#48893982)
...this is a completely normal thing to do in linux, it's the most basic form of access control. There's like a dozen non-human accounts in a clean install before adding your own like this, and a lot of software adds their own. Edit: I have 54 entries on my personal laptop, just one of which is actually me.
[ Parent | on HN ]
Re:Grok uploaded my user directory to xAI's servers by khalic on Monday July 13, 2026 @12:07PM (#48894766)
This model is already not perfect, and not at all built for agents. The only way to secure an agent is an air-gap with the execution layer. Treat it like text, and the problem never arises until you “interpret” the agent output in a more limited environment than the OS
[ Parent | on HN ]
Re:Grok uploaded my user directory to xAI's servers by dcow on Monday July 13, 2026 @11:29AM (#48894235)
Even though it’s completely normal to us and in widespread use, GP is a reminder that conceptually it’s a broken model. Security should be capability-based not user-based. And to anyone who didn’t grow up on a desktop this model makes complete sense since it’s what your phone uses.
[ Parent | on HN ]
Re:Grok uploaded my user directory to xAI's servers by Sesse__ on Monday July 13, 2026 @11:34AM (#48894313)
Android uses one uid per app.
[ Parent | on HN ]
Re:Grok uploaded my user directory to xAI's servers by dcow on Tuesday July 14, 2026 @01:52AM (#48902753)
Yes, it was a step in the right direction at the time. But there are plenty of well-documented warts with the approach which Fuchsia aimed to solve via capabilities (and which the Linux community general solved via crun).
[ Parent | on HN ]
Re:Grok uploaded my user directory to xAI's servers by warshinder on Monday July 13, 2026 @11:26AM (#48894166)
He said it’s less than a software, so saying software does this too isn’t really a strong counter argument. In case, I don’t think you are really in disagreement. Restricted accounts are necessary is your point, but I think op is saying they aren’t sufficient.
[ Parent | on HN ]
Re:Grok uploaded my user directory to xAI's servers by Izkata on Monday July 13, 2026 @11:31AM (#48894260)
One of the default users is "nobody" which isn't associated with any software. It's definitely above that.
[ Parent | on HN ]
Re:Grok uploaded my user directory to xAI's servers by warshinder on Monday July 13, 2026 @11:47AM (#48894496)
Is it less secure if I simply have nothing to do with language models whatsoever? I take that to be the parents point, but I know you are correct and yes, user restrictions should be a necessary part of the way people who use LLMs setup their system to use them in a safe manner.
[ Parent | on HN ]