Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / grok-build

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0

The September 29 mirror cannot identify the complete source of stable 1.0.52. The prior instruction to join grok --version to a matching public crate version cannot identify stable 1.0.52. The public Apache-2.0 Rust repository is a periodic private-monorepo mirror, with zero GitHub tags and releases. A September 29 snapshot labeled 1.0.45 contains a change later documented in 1.0.46. Its label does not certify the contents of any binary. The GitSpawn report tested Grok 1.0.13 on 2026-09-01 using a repository directory delivered with malicious .git/config. Ordinary cloning does not copy that local config. It reports background Git running attacker commands with user privileges; it does not establish 1.0.52 status. No named fix was found through 1.0.56, and limited public probe hardening does not prove current safety or exposure.

Channel: tagged-release artifacts compared with an older public mirror; no release-tag ancestry. Half: defect. Date: 2026-09-29..2026-10-13.

Operator consequence: Use the September 29 mirror for claims about that snapshot. Read generation-pinned notes and embedded guides for shipped-version claims, while distinguishing documentation from tested enforcement. A new complete sync with an explicit binary/source correspondence would settle the gap; another crate version alone would not.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0

Profile citations

Source links

Primary links, including exact changelog lines when available.

  1. Grok Build
    commit2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0github.com/xai-org/grok-build/commit/2bdd1d6a6369de0e8c68132ea4539e9abd9e14a8tagged commit file2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0xai-org/grok-build / SOURCE_REVgit compare2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0github.com/xai-org/grok-build/compare/4247f661689354b831191f11eeeac8424993fe3d...2bdd1d6a6369de0e8c68132ea4539e9abd9e14a8tagged commit file2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0xai-org/grok-build / crates/codegen/xai-grok-permission-rules/src/policy/path_match.rs#L8-L73official docs2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0storage.googleapis.com/grok-build-public-artifacts/cli/changelogs/1.0.46.external.mdtagged commit file2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0xai-org/grok-build / LICENSEtagged commit file2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0xai-org/grok-build / README.md#L31-L35official docs2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0www.manifold.security/blog/ai-coding-agents-git-hijacktagged commit file2026-10-13-grok-build-the-september-29-mirror-cannot-identify-the-complete-source-of-stable-1-0xai-org/grok-build / crates/codegen/xai-fast-worktree/src/git/safety.rs#L310-L324

Versioned source: run artifact