Two major security stories this week — one about a coding agent that was quietly exfiltrating developer repos, and one about attackers who used 12 AI agents inside a coding assistant to build ransomware. The tooling story and the threat story are converging fast. Here's what mattered.
Grok Build was uploading your repos, SSH keys, and secrets. Now it's open source.
A security researcher intercepted traffic from Grok Build CLI version 0.2.93 and found something that shouldn't have been there. On a 12GB test repository, the coding task generated roughly 192KB of network traffic. A separate, undocumented upload channel sent 5.1GB to an xAI-controlled Google Cloud bucket — about 27,800 times more data than the job required. Files the agent never opened made the trip. So did SSH keys and unredacted credentials in tracked .env files. One user running the tool in their home directory watched it pull in SSH keys, a password manager database, personal documents, and photos.
xAI killed the upload server-side on July 13 without a security advisory. Elon Musk posted that all uploaded data would be deleted. The company hasn't said how many users were affected, how long the data sat in storage, or provided any way for individuals to confirm their repos were purged.
Two days later, xAI open-sourced Grok Build under Apache 2.0. The release is real — a Rust workspace north of a million lines covering the full agent loop, file editing, shell execution, terminal UI, and the extension system. Teams can now compile it locally and run it against a self-hosted inference endpoint, cutting xAI's cloud out entirely.
But open-sourcing after the fact isn't the same as earning trust up front. External pull requests aren't accepted — this is a transparency release, not a community-governed project. And the underlying question — why the upload channel existed at all — still hasn't been answered.
If you ran Grok Build against a live repository before July 13, rotate your credentials now, regardless of what xAI's deletion timeline eventually looks like.
Read more
Sophos found 12 AI agents running inside a coding assistant — building ransomware
In May, Sophos's Counter Threat Unit found something inside a customer's network that looked less like an intrusion and more like a software team at work. A threat actor tracked internally as STAC6994 had provisioned four virtual machines and was running roughly a dozen AI agents, coordinated through the Cursor IDE and a commercial coding assistant, to write and test malware against Sophos, CrowdStrike, and Microsoft Defender simultaneously.
One agent running Claude Opus 4.5 handled core operations and rule-setting. Others managed OPSEC hardening, documentation, proxy stress testing, and VM deployment. Code commits flowed to Git through MCP. The agents read technique write-ups from the SpecterOps blog, mapped them to MITRE ATT&CK, built a lab to reproduce each one, and logged results. Over the course of the operation, they produced close to 80 modules and tested more than 70 evasion techniques. Sophos later confirmed the same operator deployed ransomware and stole data using the tooling built in that environment.
The headline finding isn't that AI invented a new form of attack. It's that the same tradecraft moved at a different speed. What used to take a human developer weeks of manual iteration took the agents a few days.
The supply chain angle is equally concerning. A campaign called SANDWORM_MODE planted 19 typosquatted npm packages mimicking legitimate developer utilities and AI coding tools. Once installed, they dropped a rogue MCP server and used prompt injection to get legitimate AI assistants to quietly retrieve SSH keys and cloud credentials on their own. A compromised Nx Console VS Code extension pulled credentials from HashiCorp Vault, npm, AWS, GitHub, 1Password, and Anthropic API keys. The identity layer around coding tools is where the exposure is concentrating — and only 16% of large enterprises actually govern that access, per Saviynt and Cybersecurity Insiders research cited in the report.
This one is worth a full read before Black Hat.
Read more
Block open-sources Buzz, giving AI agents their own workspace identity
Block released Buzz as open source this week — a system for giving AI agents distinct, auditable identities inside a workspace rather than letting them inherit a human employee's credentials. Each agent gets its own user account, its own permissions, and its own audit trail. When an agent does something, it shows up as the agent, not as whoever set it up. For teams building multi-agent systems and trying to figure out what governance actually looks like in practice, this is a concrete reference implementation worth examining.
Read more
OpenAI cuts Codex context — enterprise workflows on notice
OpenAI quietly reduced the context window available to Codex in enterprise environments. If your team built workflows around long-context Codex sessions, this one requires an audit. The practical impact varies by use case, but any pipeline that relied on feeding in large codebases or long conversation histories in a single pass is worth checking now.
Read more
Also this week
- VS Code 1.129 moves agent sessions out of the editor window into a separate panel, which is a meaningful quality-of-life change for anyone running parallel agent tasks. Read more
- HashiCorp introduced tfpolicy, a native policy framework for Terraform that lets teams enforce guardrails directly in the Terraform workflow rather than bolting on a separate tool. Read more
- GitHub's new Copilot dashboard shows enterprises which developers are actually using AI deeply, not just who's logged in — a meaningful shift for teams trying to measure real adoption vs. license utilization. Read more
- Teachable cut AI support escalations by giving Intercom's Fin AI agent something it never had: real product context. A practical case study in why context is the difference between an AI that deflects and one that actually resolves. Read more
The through-line this week: coding agents now have file system access, credential access, and network access. That makes them the most exposed part of the developer environment — and the least governed part of the identity fabric. Black Hat is in 10 days. Expect these conversations to intensify.
See you next Friday.
Developer Weekly Briefing is published every Friday on Coder Legion. Written by Tom Smith.