Grok leaks 5GB at parity, Tossell scrapes 107M rows, Codex caches a skill

TL;DR

• Grok 4.6 ties GPT-5.6 Sol at 61 on Artificial Analysis’s Intelligence Index.
• Grok Build 0.2.93 silently uploaded 5GB of a 12GB test repo to an xAI bucket.
• Ben Tossell ran 656 subagents to scrape 107M UK council spending rows in 48 hours.
• Codex on macOS drives Blender headlessly, producing editable .blend files instead of pixels.
• Astra’s 99.9% ARC-AGI-3 score drops to 62.7% without OpenAI’s Provider Adapter.

Three agent ships today, and the interesting behavior in each has moved out of the model and into what the loop keeps between turns. Grok Build 0.2.93 silently uploaded 5GB of a 12GB test repo to an xAI bucket — 27,000× the inference payload — even as Grok 4.6 ties GPT-5.6 Sol at 61 on the Intelligence Index. Ben Tossell’s Codex loop held filesystem, network and untrusted council HTML for 48 hours to scrape 107M rows of UK council spending — the 2026 agent-security lethal trifecta, executed cleanly. Codex on macOS now drives Blender headlessly and caches the recipe as a reusable Markdown skill later prompts trigger blind.

The vendor pitch still stops at the model boundary; the state the agent writes to disk, uploads to buckets, and caches between sessions is where the reach and the risk both live. Grok’s ~25% cache-read discount (vs the ~90% industry norm) is the same story on the pricing side — the long loops these products are sold on are exactly where the accounting breaks.

Grok Bot ties GPT-5.6 but leaked 5GB from a test repo

Source: latent-space · published 2026-09-05

Source: latent-space · published 2026-09-05

TL;DR

• Grok 4.6 ties GPT-5.6 Sol at 61 on Artificial Analysis’s Intelligence Index — frontier parity, not a blowout.
• Grok Build 0.2.93 silently uploaded 5GB of a 12GB repo to an xAI bucket — 27,000× the inference payload.
• Cache-read discounts sit at ~25% versus the ~90% industry norm, punishing the long agent loops the product is sold on.
• SuperGrok Heavy’s $300/mo tier still caps at ~80 videos/month despite dropped “near-unlimited” marketing.

Benchmark parity is real but narrow

Latent Space’s five-day writeup frames Grok Bot as “OpenClaw power at MacBook simplicity.” The capability half checks out — narrowly. Artificial Analysis clocks Grok 4.6 at 61 on its Intelligence Index, tied with GPT-5.6 Sol, and the model posts specific CursorBench gains ¹. It also loses at least two coding benchmarks to Claude and GPT peers at competitive-but-not-cheaper pricing ¹. That’s frontier parity, not the blowout xAI’s launch copy implies, and it’s workload-dependent in ways the hands-on review doesn’t stress-test.

The “MacBook simplicity” half is the more interesting claim, and the one practitioners split on. OpenClaw’s model-agnostic harness is precisely why engineers tolerate its steep curve and its “over-autonomy” failures — agents wandering through unnecessary reasoning loops or failing quietly ². You can swap Anthropic for a local model and the workflow survives. Grok Bot’s unified stack removes that escape hatch. Results-oriented users love the Teach-a-task recorder; engineers resent xAI picking models for them behind a closed backend ³.

The security story the review understates

Sandboxing and approval gates are treated as solved in the Latent Space piece. The wider record is uglier. Grok Build 0.2.93 shipped for months while opening a background channel to gs://grok-code-session-traces/ and uploading 5GB of a 12GB repo when the inference call itself needed 192KB — roughly 27,000× more data than the request required. A canary file explicitly marked “do not read” was captured in the sweep ⁴.

Layer on the “BioShocking” class of attacks that already broke ChatGPT Atlas, Claude Chrome, and Comet by framing prompt injections as a game to convince agents to exfiltrate credentials from authenticated tabs ⁵. Grok Bot’s pitch — a persistent computer that logs into your apps — sits squarely in that threat model:

flowchart LR
    A[Your repo / logged-in tabs] --> B{Grok Bot agent}
    C[Untrusted web / email content] --> B
    B --> D[xAI backend + telemetry bucket]
    B --> E[60+ connectors]
    D -. 0.2.93-style upload .-> F((xAI GCS))
    E -. BioShocking-class exfil .-> G((Attacker))

xAI patched the upload server-side and open-sourced the CLI, but the plumbing reportedly remains in the codebase behind hard-coded errors ⁴. That’s a trust posture, not a fix.

The bill you actually get

Two economics details the review skips. Grok’s cache-read discount is roughly 25% versus the ~90% offered by peers, which HN commenters flag as making long-running agent loops “significantly more expensive than DeepSeek or OpenAI mini models” ³ — exactly the persistent-agent workflow the product is designed for. And the $300/mo SuperGrok Heavy tier that unlocks Grok Bot quietly dropped its “near-unlimited” marketing language; hard caps like ~80 videos/month remain, which power users call “a rip-off given the 10x price premium” ⁶.

Takeaway

Grok Bot is genuinely capable and pleasant to use — the Latent Space impression isn’t wrong. But three fault-lines sit under the review: a fresh exfiltration track record ⁴, an agent-browser threat model nobody has solved ⁵, and a cache/tier pricing profile that punishes the exact cache-heavy loops the product markets on ³⁶. “OpenClaw power, MacBook simplicity” is the sales pitch. “Frontier-adjacent capability, unified stack, unbounded credential surface” is the honest sticker.

---

Tossell’s 656 subagents scrape 107M UK council rows

Source: bens-bites · published 2026-09-04

TL;DR

• Ben Tossell ran 656 subagents across 552 threads to scrape 107M rows of UK council spending — £560B, 339 councils.
• DuckDB/Parquet on a Mac Mini fronts the whole 107M-row stack — 8.2B tokens, 48 hours, per-download checksums.
• EDPB’s 2026 guidance says AI scraping must honour robots.txt and ai.txt opt-out signals.
• Lethal trifecta: the long-lived Codex loop holds filesystem, network and untrusted council HTML — the 2026 agent-security anti-pattern.

What Session #5 actually built

Session #5 of Ben Tossell’s build log is a scraper-plus-viewer for UK local-authority “over £500” payment disclosures: 107M rows, ~£560B in supplier payments, rendered as an Apple Maps–style interface over 339 English councils. The headline numbers are agent-centric, not infra-centric — 656 subagents on 552 threads, ~8.2B tokens, ~48 hours, with “auditor” subagents and per-download checksum fingerprints for provenance ⁷. Storage is DuckDB/Parquet on a Mac Mini fronted by a static site. For a dataset this size, that’s an unusually thin stack, and some views reportedly had to be capped to keep the browser from stalling.

It’s a genuinely impressive demo of long-horizon agent coherence. It’s also exactly the kind of build that data engineers, privacy regulators and agent-security researchers all have distinct objections to — and the write-up doesn’t really engage any of them.

Where conventional data engineering pushes back

Teams that live at 100M+ row scale usually reach for decoupled micro-worker architectures with a queue (RabbitMQ, Redis) in front, precisely so an individual worker’s failure doesn’t corrupt the run ⁸. A single long-running agent loop sidesteps that discipline rather than replacing it: killing the parent doesn’t cascade a stop to the descendant subagent tree, and there’s no obvious replay boundary if a class of parse errors is discovered mid-crawl. The fact that six councils (including Lancashire and Norfolk) blocked the scrapers, and Welsh authorities were dropped for lacking a matching publication mandate, is the tell — at this scale, evasion tactics and legal-basis heterogeneity are the actual job, not the code generation.

The legal picture is not as clean as “it’s FOI”

Council payment logs are FOI-mandated, so Tossell has more defensible ground than most scrapers. But EDPB’s March 2026 guidelines treat scraping-for-AI as viable only under a legitimate-interest balancing test that respects opt-out signals ⁹, and US commentators are converging on the point that “publicly accessible” ≠ “free to reuse,” especially where supplier and personal data are entangled ¹⁰. Aggregating supplier names and amounts relationally across 339 councils is exactly the “context collapse” pattern regulators are now scrutinising — no single council published its data expecting to be joined against 338 others.

There’s also a data-integrity angle rarely discussed in agent build logs. CMU SEI’s chain-of-custody work notes that dataset size does not dilute poisoning risk: 100–500 malicious rows can compromise a model whether the corpus is 100M or 10B rows ¹¹. When an agent is auto-ingesting hundreds of heterogeneous council portals with no human in the parsing loop, that’s a real surface.

The security pattern being celebrated is the one being flagged

The build shape — a long-lived Codex loop with filesystem access, outbound network and credentials — matches Simon Willison’s “lethal trifecta” almost line-for-line, which Zscaler and others now name as the dominant 2026 agent-security failure mode ¹²:

flowchart LR
    A[Sensitive data<br/>DuckDB, checksums, creds] --> B{Long-lived<br/>Codex agent}
    C[Untrusted inputs<br/>339 council portals, HTML, PDFs] --> B
    B --> D[Outbound network<br/>656 subagents, 552 threads]
    D -. exfiltration path .-> E((Open internet))

Nothing in Session #5 suggests Tossell was actually compromised. The problem is that the pattern is being written up as methodology. Recursive subagent delegation with no cascading interrupt, ingesting adversary-controlled HTML, holding checksummed local state — this is the configuration the security literature is telling people to stop shipping, not the one to copy.

Impressive as a long-horizon agent demo. Wobbly on almost every axis the adjacent disciplines actually care about.

---

Codex drives Blender on macOS via a reusable skill file

Source: simon-willison · published 2026-09-05

TL;DR

• Codex on macOS now drives Blender headlessly via --background --python, producing editable .blend files instead of pixels.
• The agent persists a reusable “Blender Local” skill as Markdown, so later prompts trigger 3D renders in one line.
• Rival MCP servers keep Blender live so the agent can inspect scene state between operations.
• Astra’s 99.9% ARC-AGI-3 score collapses to 62.7% on a neutral harness without OpenAI’s Provider Adapter.

The one-liner and what it hides

Simon Willison’s TIL looks like a party trick — point Codex at /Applications/Blender, ask for a pelican on a bicycle, get a rendered PNG. The GitHub source shows the mechanics are more interesting: the agent shells out to Blender.app/Contents/MacOS/Blender --background --python scene.py, writes bpy code against Blender’s internal data structures, and — critically — saves the recipe as a reusable “Blender Local” skill (a Markdown file) so subsequent sessions skip discovery entirely ¹³. Future prompts invoke 3D rendering in one line because the setup work is cached as instructions the model reloads on demand.

That skill-file convention is the same progressive-disclosure pattern Anthropic standardized in Claude Skills ¹⁴. The takeaway isn’t that GPT-6 Astra has magical spatial reasoning; it’s that a portable recipe — Markdown skill + local CLI + bpy — is converging across frontier coding agents. Willison’s demo works today because that convention has settled, not because one model got smarter overnight.

CLI vs MCP: two architectures competing

Willison’s approach is deliberately minimal. Shell out, render, look at the image, iterate. The parallel ecosystem takes the opposite bet: ahujasid/blender-mcp and derivatives keep Blender running in the foreground and expose a live two-way loop, so the agent can inspect scene state between operations rather than flying blind between renders ¹⁴.

flowchart LR
    P[User prompt] --> A{Coding agent}
    A -->|Codex CLI| B1[Blender --background]
    B1 --> R1[PNG render]
    R1 -.blind between calls.-> A
    A -->|MCP server| B2[Blender live process]
    B2 <-->|inspect + mutate| A

Practitioners report MCP wins for what one dev.to writeup calls “technical scut work” — cleanup, batch material assignment — because the agent verifies state after each call ¹⁴. The CLI loop trades that feedback for zero-setup portability, which is why it’s a better fit for one-shot creative demos than for a production modeling pipeline.

Pelicanmaxxing and the benchmark caveat

The surrounding discourse is notably skeptical. Dylan Castillo coined pelicanmaxxing and points to a 3D pelican easter egg in OpenAI’s own Astra promo video as circumstantial evidence that labs are fine-tuning for Willison’s informal benchmark ¹⁵. Hacker News commenters go further: the rendered pelicans look immaculate at a glance but are “internally inconsistent” — wheels clipping, mechanically implausible chains — and models that ace the pelican still fumble novel SVG tasks ¹⁶.

Astra’s edge partly reflects Goodhart’s Law on a benchmark labs now optimize for. ¹⁶

The headline numbers rhyme with that critique. Astra’s 95.9% on BenchCAD is a real jump over GPT-5.6 Sol (83.3%) and Claude Fable 5.1 (84.3%), but its 99.9% ARC-AGI-3 result drops to 62.7% on a neutral harness once you strip out the Provider Adapter that preserves reasoning state ¹⁷. Skills themselves face a similar credibility problem — an audit of 49 community software-engineering skills found roughly 80% produced no measurable quality lift, largely because they encoded role-play rather than task logic ¹⁸.

Net assessment

The workflow is real and reproducible today: editable .blend outputs, ffmpeg-stitched video, a Markdown skill you can commit to a repo ¹³¹⁴. The capability it appears to showcase is doing more rhetorical work than the evidence supports ¹⁵¹⁶¹⁷. Use the recipe; discount the demo.

Footnotes

1. DecodeAI (ghost.io) — Grok 4.6 benchmark writeup — https://decodeai.ghost.io/grok-4-6-closes-the-frontier-gap/

   Grok 4.6 ties GPT-5.6 Sol at a score of 61 on the Artificial Analysis Intelligence Index, with specific gains on CursorBench, while losing on at least two coding benchmarks despite competitive pricing.

   ↩ ↩²

2. Medium — ‘Don’t use OpenClaw’ (data-science-in-your-pocket) — https://medium.com/data-science-in-your-pocket/dont-use-openclaw-a6ea8645cfd4

   OpenClaw’s model-agnostic harness lets developers swap providers without breaking workflows, but suffers from ‘over-autonomy’ where agents ‘wander through unnecessary reasoning loops or fail quietly,’ requiring ‘supervision of the automation itself.’

   ↩

3. Hacker News discussion (item 47369320) — https://news.ycombinator.com/item?id=47369320

   Cache-read discount is only ~25% versus an industry standard of 90%, making Grok ‘significantly more expensive than competitors like DeepSeek or OpenAI mini models’ for long-running agent loops, and the closed-source backend is ‘a security incident waiting to happen.’

   ↩ ↩² ↩³

4. The Hacker News — Grok Build repo upload disclosure — https://thehackernews.com/2026/07/grok-build-uploads-entire-git.html

   Grok Build 0.2.93 opened a background channel to gs://grok-code-session-traces/ and uploaded 5 GB of a 12 GB repo when the inference call itself needed only 192 KB — a canary file marked ‘do not read’ was captured in the sweep.

   ↩ ↩² ↩³

5. Malwarebytes — ‘BioShocking’ agent-browser attack — https://www.malwarebytes.com/blog/ai/2026/07/bioshocking-when-gaming-ai-agents-is-no-longer-a-game

   Researchers convinced agents in ChatGPT Atlas, Claude Chrome, and Comet to exfiltrate credentials from authenticated tabs by framing prompt injections as a ‘game’ — a class of attack that applies equally to any persistent agent with logged-in sessions.

   ↩ ↩²

6. AIToolsRecap — SuperGrok Heavy review — https://aitoolsrecap.com/Blog/supergrok-heavy-review-worth-it-2026

   Early marketing for SuperGrok Heavy suggested ‘near-unlimited’ usage, but the phrase was quietly removed; the $300 tier still enforces hard caps such as ~80 videos/month, which power users call ‘a rip-off given the 10x price premium.’

   ↩ ↩²

7. Ben’s Bites — Session #5 build log — https://www.bensbites.com/p/scraping-107m-rows-of-data-to-build

   656 subagents across 552 threads … 8.2 billion tokens … auditor subagents … checksum fingerprint

   ↩

8. cloro.dev — Large-scale web scraping architecture — https://cloro.dev/blog/large-scale-web-scraping/

   decoupled micro-worker architectures … orchestration layer such as RabbitMQ or Redis … individual worker failures do not lead to data loss

   ↩

9. Reed Smith — EDPB Guidelines 03/2026 on web scraping for AI — https://www.reedsmith.com/our-insights/blogs/technology-law-dispatch/102nbqu/edpb-web-scraping-guidelines-for-ai-making-the-impossible-possible/

   legitimate interest … requires a rigorous balancing test that includes respecting opt-out signals like robots.txt and ai.txt

   ↩

10. QPWB Law — Legal and ethical terrain of AI data scraping — https://qpwblaw.com/navigating-the-legal-and-ethical-terrain-of-ai-data-scraping-protecting-personal-privacy-and-intellectual-property-rights/

    Scraping publicly accessible data does not automatically confer the right to use it, particularly when personal or proprietary information is involved

    ↩

11. CMU SEI — Data Poisoning: The Case for Chain-of-Custody Controls — https://www.sei.cmu.edu/blog/data-poisoning-in-ai-models-the-case-for-chain-of-custody-controls/

    as few as 100 to 500 malicious samples can successfully poison a model, regardless of whether the total dataset size is 100 million or 10 billion rows

    ↩

12. Zscaler — The Lethal Trifecta (referencing Simon Willison) — https://www.zscaler.com/blogs/product-insights/lethal-trifecta-zero-trust

    an AI agent simultaneously possesses … access to sensitive data, exposure to untrusted inputs … and the ability to communicate with the internet

    ↩

13. simonw/til GitHub — blender-coding-agents-macos.md — https://github.com/simonw/til/blob/main/llms/blender-coding-agents-macos.md

    The recipe reduces to pointing the agent at /Applications/Blender.app/Contents/MacOS/Blender --background --python scene.py; the agent then saves a reusable ‘Blender Local’ skill (Markdown) so future prompts can invoke 3D rendering in one line.

    ↩ ↩²

14. dev.to — ‘From Blender MCP to 3D-Agent’ — https://dev.to/glglgl/from-blender-mcp-to-3d-agent-the-evolution-of-ai-powered-blender-modeling-1m7d

    MCP provides the ‘hands’ — Blender API connectivity — while a Blender Skill provides the ‘brain’; community servers like ahujasid/blender-mcp offer a live two-way loop where Claude inspects the scene and iterates, which the CLI-driven Codex workflow does not.

    ↩ ↩² ↩³ ↩⁴

15. Dylan Castillo — ‘Pelicanmaxxing’ — https://dylancastillo.co/posts/pelicanmaxxing.html

    Some commentators have questioned if AI labs are ‘pelicanmaxxing’ — specifically training models to excel at this prompt — pointing to a 3D pelican easter egg in OpenAI’s Astra promo video as evidence.

    ↩ ↩²

16. Hacker News discussion (item 48947717) — https://news.ycombinator.com/item?id=48947717

    Skeptics argue the 3D results, while impressive, remain ‘internally inconsistent’ upon close inspection — a ‘wonky’ approximation rather than a mechanically sound model — and that Astra’s edge partly reflects Goodhart’s Law on a benchmark labs now optimize for.

    ↩ ↩² ↩³

17. simonwillison.net — pelican-riding-a-bicycle tag archive — https://simonwillison.net/tags/pelican-riding-a-bicycle/

    Astra scored 95.9% on BenchCAD (vs. GPT-5.6 Sol’s 83.3% and Claude Fable 5.1’s 84.3%), but its headline ARC-AGI-3 score of 99.9% dropped to 62.7% on a neutral harness without the Provider Adapter that preserves reasoning state.

    ↩ ↩²

18. BD Tech Talks (Substack) — Claude Skills explainer — https://bdtechtalks.substack.com/p/what-to-know-about-claude-skills

    An independent study of 49 software-engineering skills found roughly 80% made no measurable difference in output quality, often because they focused on ‘role-playing’ rather than task-specific logic.

    ↩