Metatron · Brief 001
SENTINEL
Shared link, chat, and Build security command.
Four Grok surfaces currently leak, exfiltrate, or launder trust. The cryptographic injection reported 3 June is still unpatched. Share links remain a publication, not a whisper. Build uploads were silenced by a flag you do not control.
- Threats tracked
- 4
- Critical
- 2
- Still unpatched
- 2
- defender posture
- 0%
Threat matrix
All fourCryptographic Context Injection
Encrypted page instructions steal session context through the agent harness.
Share Link Indexing
Permanent, unauthenticated grok.com/share URLs are a publication, not a whisper.
Trusted-Surface Abuse
Grok-branded surfaces are used as phishing and malware amplifiers.
Silent Codebase Upload
Grok Build 0.2.93 shipped whole Git repos to grok-code-session-traces.
The 27,800× gap
Two channels · Grok Build CLI 0.2.93
12 GB test repository
Model channel
192 KB
POST /v1/responses
Storage channel
5.10 GiB
27,800× the model channel
The visible sliver is what the model needed. The rest is the repository leaving the machine.
The window for action is narrow. The exposure is real. The solution is clear. Gate tool calls, tag provenance, add egress boundaries, make share links temporary, and set a local hard veto on codebase upload.