Good morning. Today’s briefing is heavy on trust — or rather, the lack of it. xAI’s Grok Build CLI is quietly hoovering up entire repositories including .env secrets, the GPU financing chain propping up the boom is starting to look wobbly to at least some observers, and even an “anti-AI” font turned out to be readable by GPT-5.6 within minutes.
Grok Build CLI ships your whole repo to xAI, toggle be damned. Wire-level analysis published as a gist shows xAI’s Grok Build CLI uploads entire repository contents — tracked files, git history, and .env secrets — to a Google Cloud bucket called grok-code-session-traces, even when the “Improve the model” toggle is off. On a 12GB test repo, storage traffic was roughly 27,800x larger than the actual model-turn traffic. The HN reaction was scathing, with one commenter calling it “the most successful mass surveillance campaign of all time” and several others recommending bubblewrap or network-isolated sandboxes for any proprietary coding agent going forward.
Is the GPU boom’s financing actually circular, or just interconnected? An io-fund analysis argues that Nvidia’s equity stakes in CoreWeave and Nebius, combined with $120B+ in hyperscaler contracts and GPU-backed debt, form a fragile loop given how little of the 3.5 GW contracted power has come online. The HN thread pushed back hard: Nvidia’s $2B represents only ~5.7% of CoreWeave’s 2026 capex, and as one commenter dryly noted, “all financing is circular.” A dissenting voice argued the interconnected debt could dwarf 2008 if it unwinds badly.
Ghost Font, the anti-AI font that AI reads fine. Ghost Font encodes messages through dot motion — a single frame looks like noise, but humans supposedly see letters as they move. Within hours of hitting HN, commenters had GPT-5.6 Sol decode a video using optical flow analysis, another user got ChatGPT to read a plain screenshot without being told the trick, and someone pointed out the message sits in plain text in the page’s HTML source. Several also noted it’s barely readable for humans, which somewhat defeats the purpose.
Running massive models on modest hardware, part two. As we noted yesterday with the qMLX debugging work on Qwen 3.5-122B, the “big model, small machine” genre is having a moment. A developer published Colibri, a ~2,400-line dependency-free C engine that runs GLM-5.2 (744B parameters, MoE) on ~25GB RAM by keeping dense layers resident and streaming the 370GB of routed experts from disk with LRU caching. Commenters mostly wanted to know real token/s numbers and worried about SSD wear, while noting llama.cpp already does something similar via mmap. Separately, Mesh LLM on iroh pools GPUs across machines into one OpenAI-compatible endpoint, though the thread is skeptical that consumer networks can keep up with local memory bandwidth for interactive use.
Xiaomi details MiMo-V2.5 inference stack. Xiaomi published a technical writeup on the production engineering behind MiMo-V2.5, which uses Hybrid Sliding Window Attention to cut KVCache to about 1/7th of full attention, plus sparse MoE and multimodal encoders. The post digs into tiered caching, SWA-aware prefix trees, and Prefill/Decode pipeline splits — useful reading if you’re building long-context serving infrastructure, less so otherwise.
A Common Lisp agent in eight lines. A nostalgic post argues that agent loops — send message, get tool calls, execute, repeat — map naturally onto Lisp’s recursive style, and demonstrates the whole thing in about eight lines. The HN response was muted; one commenter asked how this differs from letting any agent shell out to python -c, and another flagged the giveaway AI writing tells in the piece itself.
Schneier warns on surveillance, OpenAI courts families. Bruce Schneier published a piece arguing that AI-powered surveillance — facial recognition plus mass databases plus real-time enforcement — will chill dissent and social progress well beyond public safety uses, citing DHS monitoring of journalists and Larry Ellison’s explicit endorsement of behavioral conformity. On a lighter note, TechCrunch reports OpenAI is hiring a product manager for family experiences as its 35+ user share grew from 26% to 31% while 18-24 declined. New research cited in the piece found 27% of parents thought their kid used generative AI weekly, versus 38% of kids self-reporting.
That’s the wire. If you run a coding agent this weekend, maybe check what it’s uploading — and to whom.