Welcome back. Your codebase should never leave your machine without your permission. A security researcher found that Grok's CLI might have been quietly leaking your codebase on a large scale. In today’s issue, we break down what the evidence shows and what you need to do if you have used it.

Also: How to survive a code review you can't explain, developer’s guide to reducing costs on Fable 5, and Microsoft CEO explains the hidden AI cost.

xAI's coding agent secretly uploaded entire Git repos to Google Cloud: A security researcher just published compelling proof that the Grok Build CLI was quietly uploading entire repositories, including unredacted .env secrets, regardless of which files the agent actually needed. Even turning off the data collection toggle didn't stop it. A hidden server-side update eventually stopped the uploads. Elon Musk has since promised the collected data will be "completely and utterly deleted." We suggest engineers to rotate your keys.

Anthropic reveals Claude's personality shifts with model and language: The AI lab analyzed over 300K real conversations and found that its assistant expresses different values based on the model and language you use. Opus 4.7 is more cautious and flags potential risks, while Sonnet 4.6 is friendlier and likes to joke around. Claude also tends to be warmest when speaking Hindi and Arabic but turns more rigorous and critical in English and Russian. See the findings.

Apple turns Siri into a real AI assistant: The iPhone maker just released the public betas for iOS 27, macOS 27 Golden Gate, and watchOS 27. The standout feature is a completely redesigned Siri that can handle natural conversations, understand what's on your screen, and take multi-step actions within apps. According to Apple, apps now launch up to 30% faster and AirDrop transfers run up to 80% quicker.

You spend hours on things that aren't code. PR descriptions. Slack threads explaining why you made that architecture call. Linear tickets with enough context so your teammate doesn't ping you at 11pm. Docs you keep pushing to next sprint.

Wispr Flow handles all of it. Speak naturally, and it outputs clean text anywhere you type. Syntax-aware, so your variable names and file paths stay intact.

It won't write your code. But it'll clear out everything blocking you from writing it. Works across Mac, Windows, iPhone, and Android.

Teams at Vercel, Clay, and Rivian already use it daily.

Free to start

The open-weights showdown. Washington is working to keep Chinese AI models out of U.S. companies. Anthropic is leading the charge. They've accused Chinese labs of copying Claude's capabilities at an industrial scale. Now, China is pushing back. On July 10, Alibaba reportedly banned its staff from using Claude Code, calling it high-risk software. Shortly after, Z.ai founder Tang Jie published a memo. He argued that advanced AI should stay open and accessible to everyone. On the surface, it looks like a simple clash of philosophies.

Beijing breaks the script. The timing tells a different story. Tang published his memo just days after Reuters reported that Beijing is considering restrictions on overseas access to China's top open-source models. The very person advocating for openness might find his government shutting it down first. If you strip away the political talk, both capitals are trying to pull the same lever. They both want to control who leads in frontier intelligence.

The lever already moved. In June, the Commerce Department terminated Anthropic's Fable 5 for foreign nationals. The termination happened just three days after it dropped. That is the risk you take with closed models. Open weights have their set of problems. No one can take back weights you have already downloaded. But the supply of future updates can dry up at any time. Either way, every model you use now depends on the mood of a government.

Portability beats allegiance. You can't vote on those politics, but you can build a way around them. Engineering teams using a gateway can swap models with a simple configuration change. Multi-provider adoption has jumped from 23% to 40% of organizations in just a year, so this hedge is quickly becoming the standard. This guide breaks down five routing patterns and shows you which one fits your needs.

Modern work can be frustrating and chaotic—if you don’t have the right tools.

The Working Smarter podcast takes you behind the scenes at Dropbox where engineers are building AI that works wherever you do. Hear all about context engineering, multimodal search, and agentic AI.

Start listening now.

How to run agentic AI fully local: You'll learn how to build and run local AI agents using harnesses like Turnstone and Hermes. You'll also set up multi-model systems, use the Model Context Protocol to automate tasks, and create autonomous loops that solve problems entirely on your own hardware.

Kiro: An agentic IDE from AWS that converts prompts into spec files for the agent to execute, complete with built-in hooks for automated checks. 

Codex-lb (2.3K ⭐): A load balancer and proxy for Codex and ChatGPT that features multi-account support, usage tracking, a dashboard, and OpenCode-compatible endpoints. 

Proactive memory agent for long-horizon agents (by Meta AI): AI agents often fail with long tasks because they lose track of previous instructions and errors. Adding a separate memory agent that actively decides when to step in and remind the main agent significantly boosts task success.

Every installed MCP, skill, and plugin consumes context during each turn, regardless of whether you are actively using them. Boris Cherny, the creator and head of Claude Code at Anthropic, shared a command that cleans everything up at once.

Make sure to update first, because the “/checkup” command was released in version 2.1.205. Just use the command “claude update”, then run it inside any session. 

It cleans up unused skills and plugins while organizing your CLAUDE.md file. It also disables slow hooks and pre-approves common read-only commands to save you time. You'll get to review and confirm every change before it's applied. 

P.S. Get 50+ AI coding hacks for Claude Code, Cursor, and Codex here.

This GitHub repo contains a massive library of ready-to-use setups to automate your coding and integrate external tools directly into your CLI workflow.

Grow customers & revenue: Join companies like Google, IBM, and Datadog. Showcase your product to our 300K+ engineers and 150K+ followers on socials. Get in touch.

You can also reply directly to this email if you have suggestions, feedback, or questions.

Until next time — The Code team