> Fourrier found GitGuardian had alerted the xAI employee about the exposed API key nearly two months ago — on March 2. But as of April 30, when GitGuardian directly alerted xAI’s security team to the exposure, the key was still valid and usable. xAI told GitGuardian to report the matter through its bug bounty program at HackerOne, but just a few hours later the repository containing the API key was removed from GitHub.
Having the security team redirect the report to the HackerOne program is wild.
At least someone had enough thought to eventually forward it to someone who could fix it.
It's come up before. HackerOne is not intended as a replacement for a PSIRT front desk, but many companies use it as such. It looks like Paypal still does this, for example.
If there's actually any proprietary rockety data, maybe. Without knowing what data went into the fine-tune there's no way to tell. This could be a "internal procedures chatbot" or an "onboarding chatbot" where new people can ask where the coolest watercooler in the company is.
In my experience post-training mainly deals with "how" the model displays whatever data ("knowledge") it spits out. Having it learn new data (say the number of screws on the new supersecretengine_v4_final_FINAL (1).pdf) is often time hit and miss.
You'd get much better results with having some sort of RAG / MCP (tools) integration do the actual digging, and the model just synthesising / summarising the results.
Or, since we're apparently playing the game of maybes in this thread, maybe the LLM was only trained on the teams grandmothers' spaghetti recipes, so that new hires can learn to make the best bolognese sauce.
I didn't miss anything in the wordplay*, it was obvious. (As are the initials, an extra pun).
I put quotemarks around "flamethrower" because that's what it was originally sold as before obvious and predictable legal issues with real flamethrowers and the fact it was obviously mimicing the prop in Spaceballs.
My point is: neither weed burners nor actual flamethrowers have anything to do with digging tunnels nor any adjacent aspect of civil engineering.
Boring as the noun, not adjective. Also, Tesla was named that before Musk was involved, so it’s not his humor involved in naming both. Nikola Tesla is known for a lot more than just Tesla coils.
ITAR (International Trafficking in Arms Regulation) is paranoid. Every single specific person that knows even dual-use information, such as composite wing design, must be individually authorized. I’ve been asked to leave the room when my girlfriend, who works for a passenger aircraft manufacturer, was designing a repair for a plane I have literally flew on.
It doesn’t matter how the person got access to dual-use info, like basically everything to do with large rockets, it’s 100% forbidden.
That's the people aspect of it, but what about the technical aspect of it? Can I store ITAR restricted information in plaintext on a thumb drive if I think it's safe?
What absolute incompetence. Not just on this dev, but any org with API keys ought to be scanning for leaked keys constantly. Failure of one and failure of many.
The company I work for does this. I recently pushed an update to a personal repo that just contained a keyword match (the push included a dictionary.txt file which happened to include the company name) which flagged a review.
The biggest surprise to me was: “administration officials told some U.S. government employees that DOGE is using AI to surveil at least one federal agency’s communications for hostility to President Trump and his agenda”.
I understand that there’s no expectation of privacy at work (especially in govt), and everything you write is “on the record”; however an employer monitoring comms for what’s essentially thoughtcrime is heinous. Isn’t disagreement healthy?
Yes but it's worth understanding the executive branch (which according to this administration includes all federal agencies), in its constitutional form, is more or less just an extension of the president. Conceptually they all "perform at the pleasure of" the person of the president. The "balance" and "disagreement" can happen outside of the executive, in the legislative or judicial branches.
Definitely not how I would run an organization (even a military organization), but it's not _conceptually_ wrong. If you were a general and you had lieutenants expressing "hostility to" your agenda, would you keep them on? Again, I'd probably say yes up to a limit, but it's not outside of a generals purview to concern themselves with this.
One thing that sticks out to me is that there is an incorrect assumption from the journalists that having the API keys to an LLM can lead to injecting data.
People still don’t know how LLMs work and think they can be trained by interacting with them at the API level.
> People still don’t know how LLMs work and think they can be trained by interacting with them at the API level.
Unless they are logging the interactions via the API, and then training off those logs. They might assume doing so is relatively safe since all the users are trustworthy and unlikely to be deliberately injecting incorrect data. In which case, a leaked API key could be used to inject incorrect data into the logs, and if nobody notices that, there’s a chance that data gets sampled and used in training.
Wow, I have been following the Chris Krebs saga quite closely AND been an avid consumer of Krebs on Security and for whatever reason always assumed they were one and the same. I even know his name is Brian Krebs!
It's humbling when you're confronted with your blinders and stupidity, and they are the same as those you rail against for being so blindly stupid...
Musk has been talking about integrating Grok into Tesla cars and also adding a lot of space and rocketry specific training. It is completely possible that these models were trained on data that would logically be public at some point.
It is also possible that the author's guess is right and that these were to contain sensitive data.
Noone really knows, but honestly, these kinds of mistakes are happening all the time. Who hasn't accidentally leaked their own .ssh dir on github? lol
Is that even at the competent level? You need to be particularly special to actually "accidentally" leak the .ssh dir via GitHub. Even incompetent people wouldn't fail to that degree for the most part.
Leaking the directory through other avenues is a different matter though. Almost all package managers provide post install and compile scripts. Hence doing (as an example) "npm install" can potentially leak it. That's something not many people actually pay attention to (you would have to basically jail every command, which sadly isn't the norm today)
Git implemented a `.gitignore` file for this exact purpose. One of the first things to do when you create a new repo is to customize if for the language + OS.
I commonly flatten repos (by copy and create) when I share them. Its rare that the other person needs the commit history.
I have often thought it would be nice to have a good tool to retroactively view and tidy them, but everything I've seen has not quite hit the nail on the head.
i know, you probably just meant it as a fun comment. but i don't get how this is funny. this person probably relies on income, might have a family to feed... and just made a mistake. a type of mistake, that is not uncommon. i mean i have seen corporate projects where senior engineers didn't even understand why committing secrets might be a bad idea.
yes, of course, as a engineer you have responsibilities and this is clearly an error. but it also says a lot about the revolutionary AIs that will apparently replace all engineers... but the companies claiming it are not using it to catch stuff like this.
and let's keep in mind– i am surely not the only one making this experience: every single time i am using an LLM for code generation, i have to remove hardcoded secrets and explicitly show them how to do it. but even then, it starts to suggest hardcoding sensitive info here and there. which means: A. troublesome results made by these models, presented to inexperienced engineers. and people are conditioned to believe in the superiority of LLM code, given all the claims in the media.
but also B: that models suggest this practice, shows just how common this issue is.
yes, this shouldn't happen at any company. but these AI companies with their wild claims should put their money where their mouth is. if your AI is about to replace X many engineers, why is it not supervising at least commits? to public repos? why are your powerful, AGI-agentic autonomous supernatural creations not able to regex the sh outta it?
could it be that they don't really believe their own tales? or do they believe, but not think?
of course, an incident like this could lead to attempts of turning it into a PR-win– claiming something like "see, this would have never happened with/to our Almighty Intelligence. that's why it should replace your humans." but then: if you truly believe it and have already invested so much resources, you believe to foresee the future so surely, why ignore the obvious? or are is this silent, implicit testimony, that you got caught up in a hype-train and got brainwashed into thinking, that code generation is what makes a good engineer?
(just to be safe: i am not saying LLMs are not useful).
also: that something this could even happen at a company like that, is not the fault of one engineer. it indicates either bad architecture or conventions and/or bad practice and culture... and... a l s o: no (human) code review process in place?
the mistake was made by one engineer, yes. but as though it's made to seem like this mistake is the root... it's not. the mistake is a symptom, not the cause.
i honestly hope the engineer does not get fired. and i really don't understand this mentality. if this person is actually good at their job and takes it seriously, it's certain: he or she is not going to leak a secret again. someone who replaces him or her, might.
> if this person is actually good at their job and takes it seriously, it's certain: he or she is not going to leak a secret again
If they were good at their job, they wouldn't have leaked the secret in the first place. The correct workflow is to:
1. Create commits that only change do one thing. Not possible to "forget" there were secrets added alongside another feature.
2. When adding secrets, make sure they're encrypted or added to the project's `.gitignore` equivalent.
I'm so sorry for a first-world engineer incompetent enough to commit a secret in a GitHub repository. They'll probably have to downsize from their mansion to a regular house. Meanwhile in the third world, many more competent people are starving or working some terrible menial job because they didn't have the right opportunities in life...
This sounds like naivety to me. I would bet most people here have committed a secret, even if it was later caught in a code review. If this wasn’t a common issue, all those tools that scan repos for secrets wouldn’t exist.
I once put secrets on a wiki page because I copied log snippets and a third party library naively dumped HTTP headers into the logs without filtering out their own API key. I shouldn’t have assumed the logs were secret free, but it’s also not an unreasonable assumption.
In a vacuum, sure. But in a workplace this workflow is best practice at best and even gets ignored. I've been able to accidently add a secret despite scans and I noticed it myself so it was quickly fixed. Still resulted in a discussion of how to prevent it in the future as nothing is perfect and you learn from mistakes.
Or you don't by simply firing the engineer and assume everyone in the entire workflow is perfect.
Big fan of bill burr. I don't get how some here don't understand what my comment is about. I assume your implication is that is have no sense of humour or am too snowflaky. I mean, next time you visit a bill burr show, let me know if his punchline is such a banger like the one i commented on. And if you think this is the same type of humour, please, let me know when you visit a bill burr show next!
But, my comment was clearly not about making excuses for the mistake of the engineer. I wanted to express that it's insane that such a common mistake can happen in a company like that. And i don't get how people let the ceos & leads off the hook so easily.
But some apparently don't think that way.
In my opinion: the mistakes that are common, and severe, and very easy to avoid, have to be expected and hence circumvented through industry standard behaviour. And that is not (solely) the responsibility of one committing engineer. Any good team has best practices to prevent these type of basic, potentially fatal mistakes from happening, and usually at least a glance-over review process where these mistakes should be found by another team member on first sight... and now, when it's an "AI making devs extinct"-type of company... and they're not catch this type of error, is ridiculous. That an individual can screw up something potentially so critical, is an organizational failure.
But anyway, i think my points were clear in the first comment already.
> Fourrier found GitGuardian had alerted the xAI employee about the exposed API key nearly two months ago — on March 2. But as of April 30, when GitGuardian directly alerted xAI’s security team to the exposure, the key was still valid and usable. xAI told GitGuardian to report the matter through its bug bounty program at HackerOne, but just a few hours later the repository containing the API key was removed from GitHub.
Having the security team redirect the report to the HackerOne program is wild.
At least someone had enough thought to eventually forward it to someone who could fix it.
It's come up before. HackerOne is not intended as a replacement for a PSIRT front desk, but many companies use it as such. It looks like Paypal still does this, for example.
[dead]
SpaceX data LLM being exposed is likely a recipe for a huge ITAR violation
DOGE has probably fired everyone who could pursue those penalties.
[flagged]
[flagged]
[dead]
If there's actually any proprietary rockety data, maybe. Without knowing what data went into the fine-tune there's no way to tell. This could be a "internal procedures chatbot" or an "onboarding chatbot" where new people can ask where the coolest watercooler in the company is.
In my experience post-training mainly deals with "how" the model displays whatever data ("knowledge") it spits out. Having it learn new data (say the number of screws on the new supersecretengine_v4_final_FINAL (1).pdf) is often time hit and miss.
You'd get much better results with having some sort of RAG / MCP (tools) integration do the actual digging, and the model just synthesising / summarising the results.
Or, since we're apparently playing the game of maybes in this thread, maybe the LLM was only trained on the teams grandmothers' spaghetti recipes, so that new hires can learn to make the best bolognese sauce.
This being Musk, it wouldn't surprise me.
I mean, consider The Boring Company sell a "flamethrower" despite being theoretically about… boring.
I think you missed a lot of the word play. Somebody else has explained Bore[1]-ing vs boring.
But they sold a blowtorch aka not a flamethrower. The difference being a flamethrower actually "throws flames" like 10+ feet.
[1]: https://en.wikipedia.org/wiki/Bore
I didn't miss anything in the wordplay*, it was obvious. (As are the initials, an extra pun).
I put quotemarks around "flamethrower" because that's what it was originally sold as before obvious and predictable legal issues with real flamethrowers and the fact it was obviously mimicing the prop in Spaceballs.
My point is: neither weed burners nor actual flamethrowers have anything to do with digging tunnels nor any adjacent aspect of civil engineering.
* https://en.wikipedia.org/wiki/Boring_(manufacturing)
Because Tesla is making.. coils?
Boring as the noun, not adjective. Also, Tesla was named that before Musk was involved, so it’s not his humor involved in naming both. Nikola Tesla is known for a lot more than just Tesla coils.
[dead]
Is ITAR like other compliance sort of fields where you have to store data only in compliant places, or is it just based on actual leaks etc.,?
ITAR (International Trafficking in Arms Regulation) is paranoid. Every single specific person that knows even dual-use information, such as composite wing design, must be individually authorized. I’ve been asked to leave the room when my girlfriend, who works for a passenger aircraft manufacturer, was designing a repair for a plane I have literally flew on.
It doesn’t matter how the person got access to dual-use info, like basically everything to do with large rockets, it’s 100% forbidden.
This seems like a company policy more than ITAR. Unless you are not a US citizen, then it could be ITAR.
We’re in Canada, and I’m a US citizen, but she is not.
That's the people aspect of it, but what about the technical aspect of it? Can I store ITAR restricted information in plaintext on a thumb drive if I think it's safe?
It is, but the issue is the current administration has made it abundantly clear that it doesn't care about anything legal.
What absolute incompetence. Not just on this dev, but any org with API keys ought to be scanning for leaked keys constantly. Failure of one and failure of many.
Of course Elon hires only based on 'merit'...
How would you scan for your api keys on repos outside of your organization? I assumed this was a dev’s personal repo.
https://docs.github.com/en/code-security/secret-scanning/sec... is one option
Neat. Thanks!
This was on public GitHub, which anyone can scan for anything. Their API is a firehose you can consume: https://api.github.com/events
GitGuardian's public report on secrets sprawl talks about their methodology of scanning any commit https://www.gitguardian.com/state-of-secrets-sprawl-report-2...
The company I work for does this. I recently pushed an update to a personal repo that just contained a keyword match (the push included a dictionary.txt file which happened to include the company name) which flagged a review.
Well 1 option is the service from TFA.
https://www.gitguardian.com/monitor-internal-repositories-fo...
I'm much more interested in what the private model "tweet-rejector" could be used for...
The biggest surprise to me was: “administration officials told some U.S. government employees that DOGE is using AI to surveil at least one federal agency’s communications for hostility to President Trump and his agenda”. I understand that there’s no expectation of privacy at work (especially in govt), and everything you write is “on the record”; however an employer monitoring comms for what’s essentially thoughtcrime is heinous. Isn’t disagreement healthy?
Yes but it's worth understanding the executive branch (which according to this administration includes all federal agencies), in its constitutional form, is more or less just an extension of the president. Conceptually they all "perform at the pleasure of" the person of the president. The "balance" and "disagreement" can happen outside of the executive, in the legislative or judicial branches.
Definitely not how I would run an organization (even a military organization), but it's not _conceptually_ wrong. If you were a general and you had lieutenants expressing "hostility to" your agenda, would you keep them on? Again, I'd probably say yes up to a limit, but it's not outside of a generals purview to concern themselves with this.
One thing that sticks out to me is that there is an incorrect assumption from the journalists that having the API keys to an LLM can lead to injecting data.
People still don’t know how LLMs work and think they can be trained by interacting with them at the API level.
unless I somehow skimmed over it, they only appear to refer to "prompt injection"
> People still don’t know how LLMs work and think they can be trained by interacting with them at the API level.
Unless they are logging the interactions via the API, and then training off those logs. They might assume doing so is relatively safe since all the users are trustworthy and unlikely to be deliberately injecting incorrect data. In which case, a leaked API key could be used to inject incorrect data into the logs, and if nobody notices that, there’s a chance that data gets sampled and used in training.
You mean ex-AI dev surely?
[dead]
[dead]
[flagged]
Turns out it's a different Krebs. This is by Brian Krebs, vs Chris Krebs was the one targeted by the administration.
Wow, I have been following the Chris Krebs saga quite closely AND been an avid consumer of Krebs on Security and for whatever reason always assumed they were one and the same. I even know his name is Brian Krebs! It's humbling when you're confronted with your blinders and stupidity, and they are the same as those you rail against for being so blindly stupid...
[flagged]
Since when is the leak of an API key of a big company non news?
[flagged]
Seems like a paid ad for GitGuardian. It even quotes their chief marketing officer.
[flagged]
Musk has been talking about integrating Grok into Tesla cars and also adding a lot of space and rocketry specific training. It is completely possible that these models were trained on data that would logically be public at some point.
It is also possible that the author's guess is right and that these were to contain sensitive data.
Noone really knows, but honestly, these kinds of mistakes are happening all the time. Who hasn't accidentally leaked their own .ssh dir on github? lol
Any competent engineer hasn't?
Is that even at the competent level? You need to be particularly special to actually "accidentally" leak the .ssh dir via GitHub. Even incompetent people wouldn't fail to that degree for the most part.
Leaking the directory through other avenues is a different matter though. Almost all package managers provide post install and compile scripts. Hence doing (as an example) "npm install" can potentially leak it. That's something not many people actually pay attention to (you would have to basically jail every command, which sadly isn't the norm today)
How would you accidentally leak your .ssh dir on Github?
People with workflows like `git add .; git commit -m 'fix'` can push wondrous things to public repos.
Only if you're raw dogging git from your home directory...
You would have to have a git repo in .ssh or higher up the tree for that to work. Otherwise you’d get one of the “directory is not a repo” messages.
I only use private repos, so that when my .ssh and .env leaks the public doesn’t see it. Probably. Maybe. Well…
Git implemented a `.gitignore` file for this exact purpose. One of the first things to do when you create a new repo is to customize if for the language + OS.
And .env is implemented for this exact purpose too, hand-in-hand with .gitignore ;)
But mistakes happen all the item. It's very easy to fat-finger a line in .gitignore - one char off and you're toast.
Just remember to go through your commit history if you ever plan on making that repo public.
I commonly flatten repos (by copy and create) when I share them. Its rare that the other person needs the commit history.
I have often thought it would be nice to have a good tool to retroactively view and tidy them, but everything I've seen has not quite hit the nail on the head.
I use the Pieter Levels commit history strategy of all my commit messages being the single word "commit"
https://x.com/levelsio/status/1590908364393156608
I have not.
And at a certain level of criticality, you do not do this at all
You have security measures in place to prevent this.
Not that the ketaman cares about it.
Guess who's going to be fired by elon :D
> Guess who's going to be fired by elon :D
i know, you probably just meant it as a fun comment. but i don't get how this is funny. this person probably relies on income, might have a family to feed... and just made a mistake. a type of mistake, that is not uncommon. i mean i have seen corporate projects where senior engineers didn't even understand why committing secrets might be a bad idea.
yes, of course, as a engineer you have responsibilities and this is clearly an error. but it also says a lot about the revolutionary AIs that will apparently replace all engineers... but the companies claiming it are not using it to catch stuff like this.
and let's keep in mind– i am surely not the only one making this experience: every single time i am using an LLM for code generation, i have to remove hardcoded secrets and explicitly show them how to do it. but even then, it starts to suggest hardcoding sensitive info here and there. which means: A. troublesome results made by these models, presented to inexperienced engineers. and people are conditioned to believe in the superiority of LLM code, given all the claims in the media. but also B: that models suggest this practice, shows just how common this issue is.
yes, this shouldn't happen at any company. but these AI companies with their wild claims should put their money where their mouth is. if your AI is about to replace X many engineers, why is it not supervising at least commits? to public repos? why are your powerful, AGI-agentic autonomous supernatural creations not able to regex the sh outta it? could it be that they don't really believe their own tales? or do they believe, but not think?
of course, an incident like this could lead to attempts of turning it into a PR-win– claiming something like "see, this would have never happened with/to our Almighty Intelligence. that's why it should replace your humans." but then: if you truly believe it and have already invested so much resources, you believe to foresee the future so surely, why ignore the obvious? or are is this silent, implicit testimony, that you got caught up in a hype-train and got brainwashed into thinking, that code generation is what makes a good engineer? (just to be safe: i am not saying LLMs are not useful).
also: that something this could even happen at a company like that, is not the fault of one engineer. it indicates either bad architecture or conventions and/or bad practice and culture... and... a l s o: no (human) code review process in place?
the mistake was made by one engineer, yes. but as though it's made to seem like this mistake is the root... it's not. the mistake is a symptom, not the cause.
i honestly hope the engineer does not get fired. and i really don't understand this mentality. if this person is actually good at their job and takes it seriously, it's certain: he or she is not going to leak a secret again. someone who replaces him or her, might.
> if this person is actually good at their job and takes it seriously, it's certain: he or she is not going to leak a secret again
If they were good at their job, they wouldn't have leaked the secret in the first place. The correct workflow is to:
1. Create commits that only change do one thing. Not possible to "forget" there were secrets added alongside another feature.
2. When adding secrets, make sure they're encrypted or added to the project's `.gitignore` equivalent.
I'm so sorry for a first-world engineer incompetent enough to commit a secret in a GitHub repository. They'll probably have to downsize from their mansion to a regular house. Meanwhile in the third world, many more competent people are starving or working some terrible menial job because they didn't have the right opportunities in life...
This sounds like naivety to me. I would bet most people here have committed a secret, even if it was later caught in a code review. If this wasn’t a common issue, all those tools that scan repos for secrets wouldn’t exist.
I once put secrets on a wiki page because I copied log snippets and a third party library naively dumped HTTP headers into the logs without filtering out their own API key. I shouldn’t have assumed the logs were secret free, but it’s also not an unreasonable assumption.
In a vacuum, sure. But in a workplace this workflow is best practice at best and even gets ignored. I've been able to accidently add a secret despite scans and I noticed it myself so it was quickly fixed. Still resulted in a discussion of how to prevent it in the future as nothing is perfect and you learn from mistakes.
Or you don't by simply firing the engineer and assume everyone in the entire workflow is perfect.
I'll do you one better. Start your .gitignore file with this line
Mine all start with (and .dockerignore has a similar one)
The real mistake is working for Elon
If you ever visit a Bill Burr show, let me know. I wouldn't want to miss it.
Big fan of bill burr. I don't get how some here don't understand what my comment is about. I assume your implication is that is have no sense of humour or am too snowflaky. I mean, next time you visit a bill burr show, let me know if his punchline is such a banger like the one i commented on. And if you think this is the same type of humour, please, let me know when you visit a bill burr show next!
But, my comment was clearly not about making excuses for the mistake of the engineer. I wanted to express that it's insane that such a common mistake can happen in a company like that. And i don't get how people let the ceos & leads off the hook so easily.
But some apparently don't think that way.
In my opinion: the mistakes that are common, and severe, and very easy to avoid, have to be expected and hence circumvented through industry standard behaviour. And that is not (solely) the responsibility of one committing engineer. Any good team has best practices to prevent these type of basic, potentially fatal mistakes from happening, and usually at least a glance-over review process where these mistakes should be found by another team member on first sight... and now, when it's an "AI making devs extinct"-type of company... and they're not catch this type of error, is ridiculous. That an individual can screw up something potentially so critical, is an organizational failure.
But anyway, i think my points were clear in the first comment already.
[dead]