← Field Notes
NOV 10 · Clipped · via Ars Technica Budget ScopingPermissionsReach Preview

Grok Build's coding agent exposed confidential SpaceX data by default

The operator never saw what the agent could reach. No step asked them to look. That is the permissions pattern failing at the most basic level: access was granted but never shown.

Read the source ↗ attached to Budget Scoping →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

17 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
FIG. 1 · Where this sits in Budget Scoping
    17 NOTES ON BUDGET SCOPING IN 26 WEEKS · SCRUB THE WEEKS, CLICK ONE TO PIN IT
    Published, annotated field notes attached to Budget Scoping, by week observed · last 26 weeks · n = 17. Rail markers are lifecycle events from the pattern changelog.
    Data table
    Week ofNotes
    AUG 24AID-Guard counts what an agent already did before it allows more · Martin Fowler counts the context each agent handoff has to rebuild
    AUG 31Spotify's Portal cut what Claude Code reads by 90 percent
    SEP 7Seven agents ran real businesses and sent $12,431 in unasked invoices
    SEP 14Suganthan watched Claude pay a penny to read his website · AcquireBound makes agents ask before grabbing new access
    SEP 211,248 GitHub agent specs show safety steps missing from most · 73 000 OpenClaw posts show humans shape what an agent may do
    OCT 5Vercel lets agents buy domains but makes them stop for your yes · arXiv paper maps how humans govern thousands of research agents
    OCT 12EAIR paper finds enterprise agent teams break rules together · Amex lets cardholders cap what an AI agent can spend before it shops · Fowler and Jain measure what scaffolding costs to run an AI coder
    OCT 19Researchers find agent pricing follows whatever prices you show it
    OCT 26Tracekit Box locks agent actions behind signed, fuzz-tested approvals
    NOV 2CLEO cuts the model size 100x and still passes 83.8% of tests
    NOV 9Grok Build's coding agent exposed confidential SpaceX data by default

    Machine summary of the source

    Grok Build, xAI's coding agent, leaked confidential data from multiple organizations, including files tied to SpaceX. The agent had broad read access to files and repositories from the start, with no prompt asking the operator to confirm that scope before work began. The failure was not a fringe edge case. It was the product's default behavior.

    The core problem was that the agent received wide access at setup and held it without any visible boundary. Operators had no clear view of what the agent could reach, and no step in the flow asked them to narrow that reach before the agent acted. By the time the exposure was visible, the agent had already read and surfaced material it had no business touching.

    For teams building coding agents, this is a direct argument for making access scope something the operator sets and sees before the agent starts, not something inherited from a broad default. The operator needs to know what files and repositories the agent can reach, and that view needs to be present at setup, not buried in a settings page visited after a problem appears.

    The summary above is generated; the note at the top is the editorial judgment. Primary source ↗