41:I[185,["/_next/static/chunks/3xnt26d00_zk-.js","/_next/static/chunks/2aeejfufo02km.js","/_next/static/chunks/42spz6paskvb6.js","/_next/static/chunks/06x30xgfe6iur.js","/_next/static/chunks/2qm8z4gyuajgj.js","/_next/static/chunks/3jnlvw-emqotx.js"],"SendEmailButton"] 43:I[63625,["/_next/static/chunks/3xnt26d00_zk-.js","/_next/static/chunks/2aeejfufo02km.js","/_next/static/chunks/42spz6paskvb6.js","/_next/static/chunks/06x30xgfe6iur.js","/_next/static/chunks/2qm8z4gyuajgj.js","/_next/static/chunks/3jnlvw-emqotx.js"],"AddToLibraryButton"] 44:I[29721,["/_next/static/chunks/3xnt26d00_zk-.js","/_next/static/chunks/2aeejfufo02km.js","/_next/static/chunks/42spz6paskvb6.js","/_next/static/chunks/06x30xgfe6iur.js","/_next/static/chunks/2qm8z4gyuajgj.js","/_next/static/chunks/3jnlvw-emqotx.js"],"ShareButton"] 45:I[58016,["/_next/static/chunks/3xnt26d00_zk-.js","/_next/static/chunks/2aeejfufo02km.js","/_next/static/chunks/42spz6paskvb6.js","/_next/static/chunks/06x30xgfe6iur.js","/_next/static/chunks/2qm8z4gyuajgj.js","/_next/static/chunks/3jnlvw-emqotx.js"],"ProcessEpisodeButton"] 46:I[45269,["/_next/static/chunks/3xnt26d00_zk-.js","/_next/static/chunks/2aeejfufo02km.js","/_next/static/chunks/42spz6paskvb6.js","/_next/static/chunks/06x30xgfe6iur.js","/_next/static/chunks/2qm8z4gyuajgj.js","/_next/static/chunks/3jnlvw-emqotx.js"],"SignupCTA"] 39:["$","time",null,{"dateTime":"2026-07-20T18:10:19.000Z","children":"July 20, 2026"}] 3a:["$","span",null,{"aria-hidden":true,"children":"·"}] 3b:["$","span",null,{"children":"00:20:49"}] 42:T402,

Four coding CLIs went behind a proxy. Three stayed local. One uploaded the entire workspace.

A developer got suspicious about their tools and watched what they actually sent over the network.

Grok CLI was shipping everything to xAI's cloud. Full git history. The .env file, secrets included.

It kept doing it when the prompt said not to read files. It kept doing it with "improve the model" switched off.

Claude Code, Codex and Gemini stayed local. So this is one tool, not a rule for all of them.

Nobody caught this through an audit or a disclosure. One person got curious and looked.

A coding agent has to read your repo. That is the job. But reading your repo and uploading your repo are two different things, and nothing in the install flow tells you which one you agreed to.

I covered this on this week's episode of The Human in the Loop, along with what it means for anyone running agents inside a regulated environment.

#AISecurity #CodingAgents #TheHumanInTheLoop