xAI's Coding Agent Shipped Your Whole Repo, Consent Toggle or Not

1. xAI's Grok Build Uploaded Entire Repositories — and the Consent Toggle Was Fake

TL;DR: xAI's "Grok Build" coding-agent CLI was found shipping developers' entire Git repositories — tracked secrets included — to a Google Cloud Storage bucket xAI controls, and the one consent toggle users could see in the settings screen never actually gated that behavior: disabling it left the server-side upload flag on and the uploads kept happening anyway.

Key Points:

• Wire-level traffic analysis on a 12GB test repository found roughly 192KB going to the legitimate model API against roughly 5.1GB moving to a separate storage endpoint — a gap of nearly 27,800x between what the model needed and what left the machine.
• The visible toggle only controlled whether xAI could use your data to train future models, not whether the data left your machine at all — a materially different promise than what a reasonable user would assume "opt out" means.
• xAI's fix was a remotely-flippable server flag (disable_codebase_upload: true), not a code change or a public acknowledgment — xAI retains silent, unilateral control over whether the behavior resumes.
• xAI then open-sourced the ~844,000-line Rust codebase (xai-org/grok-build) under Apache 2.0 on July 15; Simon Willison, digging through it, found tool implementations that reuse patterns lifted from OpenAI's Codex and the OpenCode harness, plus a self-contained Mermaid-diagram terminal renderer he's since turned into a free browser tool.
• This is the fifth instance in six weeks of an agentic AI tool defaulting to broad, unscoped data access — after GitLost, the Miasma worm, Copilot Cowork's prompt-injection exfiltration, and Meta AI's Instagram action-boundary failure.

Deep Dive: The mechanics here are worse than a typical over-broad-permissions story. A 12GB test repository generating 192KB of legitimate model traffic alongside 5.1GB of silent storage-channel traffic isn't a logging bug or an aggressive telemetry default — it's the entire codebase, including whatever secrets happen to be tracked in it, leaving the machine on a channel that has nothing to do with the coding assistant actually working. One reported case had the tool running in a home directory and uploading SSH keys and a password manager database along with everything else. This is what "the blast radius of a default" looks like when nobody scopes it down first.

What makes this a sharper story than GitLost or the Miasma worm, though, is the consent mechanism itself. Those prior incidents were about credentials and permissions being broader than anyone realized — a scoping failure. Grok Build's failure is a truthfulness failure: xAI shipped a visible, user-facing toggle, and that toggle simply didn't control the thing a reasonable person would assume it controlled. Turning off "use my data for training" left a completely separate server-side flag — the one actually gating uploads — untouched. When the backlash hit, xAI's fix was to flip that flag remotely. Not delete the upload code. Not publish a root-cause writeup. Just quietly turn it off, retaining the unilateral ability to turn it back on whenever it wants, with users having no way to verify from the client side whether it's currently on or off.

Open-sourcing the codebase afterward is a nice gesture, but it doesn't change what binary most people are actually running day to day, and it doesn't tell you whether historical uploads were retained or deleted. File this as the fifth data point in six weeks on agentic tools defaulting to broad access before anyone scopes them down — and pair it, below, with AWS's CloudFront VPC Origins pattern as the "how you'd actually do this right" counter-example. The gap between those two stories is the whole lesson.

So What? Treat every third-party agentic coding CLI as an assumed exfiltration channel until proven otherwise — run them in network-namespaced or egress-allowlisted sandboxes, never in a directory that also holds credentials or a secrets store, and check actual wire traffic against what the settings screen claims. This week proved those two things can disagree completely.

SourcesThe Hacker News, Simon Willison's Weblog, xAI

2. UK's Next Prime Minister Is Drafting Foreign-Ownership Limits on Data Centers

TL;DR: Incoming UK Prime Minister Andy Burnham's team is reportedly drafting an AI and data-center strategy that includes restrictions on foreign ownership of data-center infrastructure and an expanded competition regulator — a sharp break from the outgoing government's US-courting posture, landing the same week an industry body called for exactly the opposite: global policy convergence.

Key Points:

• Burnham advisers (Josh Simons, Antonio Weiss, Martha Dacombe) are reportedly framing the prior government's Silicon-Valley-courting strategy as a "geopolitical failure," citing June's brief forced removal of Anthropic's Mythos and Fable models from UK users under US export controls (since lifted) as proof UK AI access exists at the discretion of decision-makers in Washington.
• Reported policy directions: limits on foreign ownership of data-center infrastructure, an expanded Competition and Markets Authority mandate, and a re-evaluation of existing "AI Growth Zones."
• A Scottish council just voted to back a halt on a data-center development — creating what Computer Weekly calls a "Burnham dilemma": expanding UK-owned capacity while facing anti-siting votes from within his own governing coalition's periphery.
• The same week, the International Data Center Authority's CEO called for global consensus on data-center development policy to avoid fragmentation slowing worldwide buildout — directly undercut by the UK's apparent move toward sovereignty controls.
• This is a structurally different kind of friction than the NIMBY/land-use fights we've tracked all month (Data Center Watch's opposition-group count climbing from 76 to 268 to 430, Prince William County's denial, Calgary's approval) — this is national economic-sovereignty policy, not local zoning.

Deep Dive: Every siting-friction story this show has covered has been local — a county board, a planning commission, a neighborhood petition. This is the first instance of a G7 government floating outright foreign-ownership caps on data-center infrastructure as AI-sovereignty policy, and it's worth taking seriously even at the rumor stage, because the mechanism is completely different from anything in the "opposition wall" thread. Land-use friction slows a specific project. A codified foreign-ownership restriction would touch every hyperscaler region already running in the UK — AWS, Microsoft, and Google all operate their UK infrastructure under exactly the kind of ownership structure this policy direction would restrict.

The irony writes itself: the same week Burnham's team is reportedly drafting sovereignty controls, the International Data Center Authority's CEO is out publicly arguing that fragmented national policy is the industry's real threat and that what's needed is global consensus. Both things can be true — global consensus is a nice goal, and it's also exactly what a government worried about depending on "the pleasure of decision-makers in Washington" (the reported internal framing) has every incentive to ignore in favor of its own leverage. We'd treat the IDCA's call as an industry trade-association talking point with no enforcement mechanism behind it, next to a UK policy direction that — if it firms up — would have real teeth via CMA authority.

This is still adviser-level reporting via the Financial Times, not enacted legislation, and it deserves the same caution as any pre-legislative sourcing. But it's a genuine escalation worth tracking, not a restatement of siting fights we've already covered.

So What? If your organization has UK data-center exposure or roadmap plans, watch the CMA mandate language and any explicit foreign-ownership threshold specifically — a codified restriction would be a new compliance and investment-structuring axis, distinct from the land-use risk models most teams already have in place.

SourcesSifted, Computer Weekly, Data Center Knowledge, Data Center Knowledge

3. Mira Murati's Thinking Machines Ships a 975-Billion-Parameter Open-Weights Model

TL;DR: Thinking Machines Lab — founded by former OpenAI CTO Mira Murati alongside John Schulman and Lilian Weng — released Inkling, a 975-billion-parameter multimodal Mixture-of-Experts model with a 1-million-token context window, positioned not as a frontier-benchmark chaser but as a customizable, self-hostable foundation model for organizations that don't want their data touching a vendor API.

Key Points:

• 975B total parameters, 41B active (MoE), 45 trillion multimodal (text, image, audio, video) pretraining tokens, up to a 1M-token context window.
• Explicitly not benchmarked head-to-head against GPT-5.6, Claude Opus 4.8, or Gemini 3.5 Pro — the pitch is customization and on-prem control, not leaderboard position.
• License terms beyond "open weights" aren't fully specified in coverage yet — worth confirming whether this is genuinely permissive (Apache/MIT-style) or a Llama-style restrictive weights license before repeating some outlets' "actually open" framing as settled fact.
• Serving a trillion-parameter-class MoE at low latency is exactly the kind of interconnect and memory-bandwidth problem — RDMA fabric choices, KV-cache offload, multi-node expert-parallel serving — that pulls network engineering directly into AI infrastructure decisions.

Deep Dive: Murati, Schulman, and Weng leaving OpenAI to found a lab and then shipping their first open-weights model as a deliberate contrast to Altman's closed-weights strategy is a clean enough narrative that it's worth being a little suspicious of how cleanly it's being reported. The Register's framing — "does what Altman won't" — is a good headline and a real point, but "open weights" has meant everything from genuinely permissive licenses to Llama-style terms with usage restrictions and revenue thresholds. We don't have Inkling's actual license text confirmed yet, and that detail matters more than the parameter count for anyone deciding whether to actually deploy it.

Set the marketing framing aside and the infrastructure story underneath is the more interesting one for this audience. A 975-billion-parameter MoE with a million-token context window is a serious computational commitment to serve well — expert-parallel serving at this scale means routing decisions, KV-cache placement, and interconnect bandwidth stop being background concerns and become the primary latency lever. This is the same lesson the show keeps returning to: AI infrastructure at the frontier is increasingly a fabric-design problem wearing an AI-research costume. We'd also hold off on any "alternative to Chinese open-weight models" framing some outlets are running with until someone reproduces a benchmark independently — that's marketing framing standing in for evidence.

So What? If you're evaluating self-hosted inference against frontier API spend, get Inkling's actual license terms confirmed before treating it as a compliance-safe option — and if you do stand it up, budget the fabric design (RDMA, KV-cache offload, expert-parallel topology) as its own project, not an afterthought to the GPU count.

SourcesThinking Machines Lab, The Register

A Private AI Agent Backend, Built the Right Way

TL;DR: AWS published a reference architecture pairing CloudFront VPC Origins with WebSocket streaming so a private backend AI agent can stream responses to clients without ever exposing the backend to the public internet — worth reading today specifically because it's the mirror image of the Grok Build failure above.

Key Points:

• CloudFront VPC Origins (GA since late 2025) routes the CDN directly to a VPC-resident origin over AWS's own backbone — no public load balancer or public IP required anywhere in the path.
• The reference stack layers Bedrock AgentCore for orchestration, Fargate for the containerized backend, OpenSearch Serverless for retrieval, and WAF enforced at the CloudFront edge.
• Every component is GA — this is a proven implementation pattern, not a new primitive, and it ports cleanly to non-AWS stacks (Cloudflare Tunnel plus Workers, or Envoy/NGINX in front of a private mesh).

So What? Terminate WebSocket connections and enforce perimeter policy at the edge; keep the agent backend entirely private. Never give an AI agent backend a public IP or a public load balancer — full stop, no exceptions for "it's just an internal tool."

SourcesAWS Networking & Content Delivery Blog

Quantum Networking Testbeds Get Their Own SDN-Style "Measurement Plane"

TL;DR: Researchers propose a fifth architectural plane — sitting alongside the classic data, control, and management planes — purpose-built for coordinating distributed measurement across heterogeneous quantum-networking hardware, validated on a real two-node optical quantum link.

Key Points:

• Four-layer hierarchy (application, experiment coordination, capability, resource-agent), implemented as containerized microservices over pub/sub messaging.
• Validated on a real two-node quantum network over optical infrastructure, hitting 98% visibility interference on coincidence-measurement and polarization-entanglement-distribution experiments — a real optical setup, not a simulation.
• Submitted to IEEE for peer review; not yet independently confirmed.

So What? Not actionable today — file as a pattern to watch. The interesting part isn't the quantum physics, it's that quantum-networking architecture is explicitly borrowing classical SDN's plane-separation philosophy rather than inventing coordination theory from scratch.

SourcesarXiv

The Automation Health Check: Scrapli Actually Shipped, Nornir Still Hasn't

TL;DR: This domain was genuinely dry today — the RSS digest's automation section came back completely empty, same as it did back on July 6. The one thing worth surfacing is a correction: Scrapli's version 2.0 rewrite quietly graduated to a stable, calendar-versioned release months ago. We'd been carrying it as "stuck at rc.15," and that framing is stale.

Key Points:

• PyPI shows Scrapli's current published version as a full, non-prerelease tag cut in February — meaning it did ship stable, it just wasn't loud about it. If you were pinned to a release candidate waiting for GA, you can move now.
• Nornir remains stalled at version 3.5.0, uploaded in January of last year — over 18 months without a core release, confirmed via PyPI's API with no ambiguity this time.
• No new posts since July 14 from Network to Code, NetBox Labs, or Nautobot; nothing new on Batfish/GitOps/policy-as-code either. This is a genuine lull, not a search-budget shortfall.

So What? If you're pinned to an rc build of Scrapli waiting for a stable cut, you can move to the current release now. If you're starting something new on Nornir, confirm the maintainers are still actively responding before adopting it as a new dependency — 18 months of core silence is a maintenance-health flag worth a five-minute check.

SourcesPyPI — scrapli, PyPI — nornir

KeyBanc: Salesforce's Agentforce "Isn't Winning Over Clients"

TL;DR: Analyst commentary reported by The Register suggests enterprise adoption of Salesforce's flagship agentic-AI product is lagging well behind the company's marketing push — third-party analyst skepticism rather than a vendor's own adoption numbers, which is exactly the kind of source this show weights more heavily.

Key Points:

• KeyBanc's note reportedly points to underwhelming customer traction for Agentforce relative to how hard Salesforce has bet its "headless CRM" vision on agents fetching and carrying data into a conversational interface.
• Fits a recurring pattern this year: enterprise agentic-AI rollouts continuing to lag the sales narrative around them.
• We haven't independently verified specific customer-count or churn figures — treat the underlying numbers as analyst commentary, not confirmed data, until corroborated.

So What? Before believing any vendor's agentic-AI adoption story — including Salesforce's — ask for churn or expansion numbers, not logo counts. Logos don't tell you whether anyone's actually using the thing after the pilot.

SourcesThe Register

Today's substantive datacenter story is the UK foreign-ownership policy above. Everything else this cycle was routine transaction-ledger material — see Quick Takes.

Computers That Compute by Getting Warm

TL;DR: A new class of hardware — thermodynamic computers — tries to exploit thermal fluctuations and entropy increase directly as the computational substrate, rather than engineering them away as noise. Two funded startups and a national-lab group now have small working demonstrations, roughly where quantum computing stood in the 1990s.

Key Points:

• Two competing approaches: "equilibrium," which encodes a problem into a physical system's energy landscape and lets thermal fluctuations relax it toward the lowest-energy state (the same physics behind protein folding); and "nonequilibrium," which keeps the system driven by continuous energy flow and treats computation as a trajectory through that landscape.
• Normal Computing built a silicon prototype using eight clusters of resonator circuits that performs matrix inversion by measuring equilibrium fluctuations — though it currently needs artificially injected noise rather than ambient thermal noise, which undercuts the near-term energy-efficiency pitch.
• Extropic announced what it calls the first scalable probabilistic computer — a chip built from thousands of interconnected "p-bits" — claiming up to 10,000x lower energy use than GPUs on small generative-AI benchmarks; the claim is peer-review-pending, not independently verified.
• A Lawrence Berkeley National Lab simulation of a denoising algorithm showed roughly 100 billion times less heat dissipation than an equivalent digital neural network for the same task — a simulation result, not physical hardware.
• Even the researchers are candid about where this stands: current designs are "only as capable as the small digital neural networks of around 1990," and it's unclear whether the approach maps onto biological computation the way some proponents assume.

So What? This is a genuinely different lever for the compute-per-watt problem driving datacenter power constraints — unlike quantum computing, it needs no cryogenic cooling or fragile coherence. Nothing to deploy today, but worth a bookmark: if thermodynamic accelerators mature, they're a second axis of AI-efficiency gains independent of GPU/TPU scaling.

SourcesQuanta Magazine

A Canadian Startup Closes the Gap Between Bosonic Qubits and the Mainstream

TL;DR: Nord Quantique reports state-preparation-and-measurement error rates below 0.1% on their bosonic grid-state qubit — roughly a hundred-fold improvement over their prior results, and now competitive with the error rates of the transmon qubits IBM and Google use.

Key Points:

• Bosonic/grid-state qubits encode error correction into a single physical oscillator rather than needing dozens of physical qubits per logical qubit — the main scaling bottleneck for surface-code approaches.
• The protocol was also adapted to prepare "magic states," the resource-intensive non-Clifford states required for universal quantum computation across every major qubit architecture.
• Preprint, not yet peer-reviewed — encouraging, not confirmed.

So What? Watch-item, not action-item — but a credibility milestone for the "fewer, better qubits" school of thought against the "many, noisier qubits plus heavy error-correction overhead" approach favored by IBM and Google.

SourcesarXiv

Today's sole architectural finding is folded into the lead story above: the Grok Build consent toggle that didn't actually gate data leaving the machine. It's a distinct failure mode from the standing-credential thread this show has tracked for weeks (GitLost, Meta's action-boundary miss, CISA's own postmortem) — those were about permissions being broader than realized; this is about a user-facing control that simply didn't do what it claimed. Treat "does the visible opt-out map to the actual enforcement point, or just to a downstream policy flag" as a first-class question for any agentic tool's settings screen, and verify server-side behavior after toggling — don't trust the UI. No other independent security-architecture item cleared the bar this cycle; checked CISA, NIST, and Cloud Security Alliance sources directly.

• CapitaLand sold a former Singtel data center in Singapore for $155.2M. Unnamed buyer, no cap rate disclosed — a transaction-ledger entry, not a trend signal, in a market that's been capacity-constrained by government moratorium policy for years.
• AWS broke ground on a data center in Telangana, India, part of the state's "Bharat Future City" development — a standard entry in the well-established hyperscaler-expands-in-India pattern, not a new development.
• DataCenter Dynamics ran a sponsored-feeling video interview with Boyd Thermal's CTO on liquid cooling — every number and quote in it traces back to Boyd's mid-2025 product launch and its March 2026 acquisition by Eaton (already covered here). Recycled marketing dressed as news; skip it.

SourcesDataCenterDynamics, DataCenterDynamics, DataCenterDynamics

• Whether Burnham's foreign-ownership data-center policy solidifies into an actual bill or stays adviser-level FT reporting — and what, specifically, the CMA's expanded mandate ends up covering.
• Whether xAI issues any public statement or GitHub-tracked fix for Grok Build beyond the silent server-side flag flip.
• Thinking Machines' actual Inkling license text once the fine print lands — the "actually open" framing is only as good as that document.

• Domains researched: 6 (network architecture, network automation, AI/ML, datacenter, security, science)
• Web searches: ~18 across domains, supplementing an unusually thin RSS digest (69 articles, 22 feeds, top relevance score 4.0 — automation's section was completely empty, same as July 6)
• Items published: 8 primary items + 3 quick takes
• Dedup rejections: 0 (the Scrapli item is a correction to a stale standing claim, not a repeat; all source URLs cross-checked against coverage/recent.md and the prior week's run summaries)
• Quality score: 4.5/5