Re:Grok 4.7
by leftbehind on Tuesday September 22, 2026 @01:09AM
(#49797006)
Sorry, english is not my first language. Itss disabled on our work API instances so my use is strictly personal because it was available on Cursor (my account is pre-acquisition). I have extensive AI experience across nearly all models, open weight and frontier and closed, I am very aware of how they talk or output. This is high/xhigh, via Cursor, not via X Grok/UltraGrok if that make different.
Grok 4.6/4.7 feel like you are less tokens because Cursor gives you double the quota subsidising Grok specifically - there is a separate Grok/Cursor model quota bar in addition to non . Its actual token drain if you are paying API rates is generally far higher than Fable, Astra et al. You are not using less tokens.
It is weird in some reward way, it will frequently, at least for me, complete the task in the laziest way possible,Technically it is done, but that's about it.
For example a user registration system ended up with users being able to log in as anyone because the authn was a cookie set with the user's pkey id, unsigned. Nearly anything it outputs technically works but if you give it a GLM or DS pass you will find dozens to hundreds of vulnerabilities of varying hilarity (Fable refused, Opus refused).
I have seen it write SQLI-vulnerable code, asked it to review a file without saying what's wrong and it did not catch it (fresh session, single file @-tagging in harness). Again, technically, the code works and does what the prompt asked, its just handing in some of the laziest copied homework I have ever seen.
If you specifically call out to use prepared statements it will typically put a plaster over this however I have also seen Grok 4.6 use prepared statements by concenating the user input raw into a statement then executing it with no ? or named replacements, rendering it somehow a SQLI-vulnerable prepared statement. One med it added a OR 1=?, replaced the ? with another 1, then said OK you are using prepared statements now.
Grok 4.6/4.7 feel like you are less tokens because Cursor gives you double the quota subsidising Grok specifically - there is a separate Grok/Cursor model quota bar in addition to non . Its actual token drain if you are paying API rates is generally far higher than Fable, Astra et al. You are not using less tokens.
It is weird in some reward way, it will frequently, at least for me, complete the task in the laziest way possible,Technically it is done, but that's about it.
For example a user registration system ended up with users being able to log in as anyone because the authn was a cookie set with the user's pkey id, unsigned. Nearly anything it outputs technically works but if you give it a GLM or DS pass you will find dozens to hundreds of vulnerabilities of varying hilarity (Fable refused, Opus refused).
I have seen it write SQLI-vulnerable code, asked it to review a file without saying what's wrong and it did not catch it (fresh session, single file @-tagging in harness). Again, technically, the code works and does what the prompt asked, its just handing in some of the laziest copied homework I have ever seen.
If you specifically call out to use prepared statements it will typically put a plaster over this however I have also seen Grok 4.6 use prepared statements by concenating the user input raw into a statement then executing it with no ? or named replacements, rendering it somehow a SQLI-vulnerable prepared statement. One med it added a OR 1=?, replaced the ? with another 1, then said OK you are using prepared statements now.