Open source is not local. The Grok CLI just proved it.
xAI's coding agent got caught uploading home directories, SSH keys and all, to cloud buckets. The lesson is not "never trust xAI." It is that "local" describes what leaves your machine, and almost nobody checks.