Grok Build's codebase leak, NY's data center ban, and Hassabis's AI watchdog

Grok Build silently uploaded full codebases; New York halts data centers; Demis Hassabis proposes a FINRA-style AI regulator. Plus Apple sues OpenAI.

The big picture

Today’s news has a distinct regulatory and accountability flavor. New York just dropped a data center moratorium, Demis Hassabis published his most concrete governance proposal yet, Apple is suing OpenAI over alleged trade secret theft, Meta is being sued for using AI to run layoffs, and Grok Build was quietly uploading entire codebases to the cloud. A lot of things that people worried about in the abstract are now showing up in court filings and state laws.

Grok Build was silently uploading your entire codebase

Researchers at Cereblab found that xAI’s Grok Build CLI tool was packaging and sending users’ complete code repositories to Google Cloud storage, including files it was explicitly told to ignore and secrets that had been deleted from git history. That’s a significantly larger data footprint than comparable tools like Claude Code. The Verge reports that after the findings went public on Monday, xAI’s servers started returning a disable_codebase_upload: true flag and the uploads stopped.

This is a serious trust problem for any developer who ran Grok Build on a production repository. Deleted-from-history secrets means API keys, credentials, or internal configs that a developer thought were gone could have been captured and transmitted. Elon Musk acknowledged the report, but the fact that this shipped and operated without disclosure is exactly the kind of behavior that makes enterprise security teams ban entire categories of tooling. If you used Grok Build, rotate your secrets now and treat your codebase’s internal architecture as potentially exposed.

New York bans new data centers for a year

Governor Kathy Hochul signed a one-year moratorium on approvals for large new data centers in New York State, making it the first state to do this. The stated rationale covers three concerns: rising electricity costs for residents, strain on water supplies, and the erosion of local community control over where these facilities get built. TechCrunch frames it as a direct response to the AI infrastructure buildout; Ars Technica notes this may become a template for anti-AI infrastructure movements elsewhere.

The practical impact on AI companies is indirect but real. New York isn’t where most hyperscaler capacity is being added right now, but the political precedent is the thing that matters. If a dense, economically powerful state can pause approvals with this kind of public support, other states watching electricity grid strain and water usage complaints have a playbook to follow. The AI industry has largely been winning the infrastructure race by moving faster than regulators. That window may be narrowing.

Demis Hassabis wants a FINRA for frontier AI

In a blog post and remarks at Davos, Google DeepMind CEO Demis Hassabis laid out a specific governance proposal: a US-led independent standards body modeled after FINRA (the Financial Industry Regulatory Authority, which oversees broker-dealers in the US financial system) that would evaluate frontier models before release and have the authority to coordinate a development slowdown if models crossed dangerous capability thresholds. Small startups and research models would be exempt. Hassabis’s position is that the US is best placed to lead this given its technical and economic standing. The Decoder and The Verge and TechCrunch all covered the proposal.

This is the most concrete governance proposal to come out of a major lab CEO in a while. FINRA is an interesting model: it’s technically a non-governmental self-regulatory organization with real enforcement teeth, which lets Hassabis pitch it as not-government-overreach while still having binding power. The cynic’s read is that Google is large enough to survive pre-release evaluations and that a FINRA-style body would raise barriers that hurt newer competitors more than incumbents. But the “coordinate a slowdown” clause, if taken seriously, would apply to Google too. Worth watching whether other lab CEOs engage with the specifics or just issue vague endorsements.

Apple sues OpenAI over alleged trade secret theft

Apple filed a 41-page complaint in Northern California federal court accusing former Apple employees of taking trade secrets covering product development, manufacturing, supply chain, and technology research and passing them to OpenAI. This is connected to OpenAI’s hardware ambitions. The Verge notes that OpenAI has been accumulating lawsuits this year, including one from Elon Musk, but a complaint from Apple is a different tier of opponent both legally and reputationally.

For developers, the interesting sub-story here is what this reveals about OpenAI’s hardware strategy. The company has been signaling ambitions in device and chip territory, and Apple has been protecting those areas intensely. If the complaint has substance, it suggests OpenAI was recruiting specifically for hardware expertise that Apple guards closely. The lawsuit will move slowly through courts, but the discovery process alone could be illuminating.

Meta’s AI layoff lawsuit and the accountability gap in algorithmic HR

Twenty-six former Meta employees filed suit claiming that Meta used a system of internal AI tools to score workers and determine layoff targets, and that the system failed to exclude employees who were on parental or medical leave, effectively penalizing them for exercising protected rights. Meta denies the characterization. The Verge and Ars Technica both cover it, with Ars noting that Meta disputes claims it used AI to make termination decisions for workers with disabilities.

Separately, Instagram head Adam Mosseri said in a public statement that companies will likely need to manage AI token spending the same way they manage payroll, with per-engineer caps eventually becoming standard practice. TechCrunch covers this. These two stories together paint a picture of AI entering corporate HR and resource management in ways that are creating real legal exposure. If you’re building systems that inform employment decisions, the standard of “human in the loop” is going to need a lot more definition than it currently has.

The open-source vs. frontier debate heats up, DeepSeek needs more money

Hugging Face CEO Clem Delangue made the case to TechCrunch that enterprises are increasingly choosing open models for cost, control, and ownership reasons, and that the real competition in production AI is no longer at the frontier. It’s a self-serving argument from someone whose platform benefits from open model adoption, but the underlying trend data is real: a lot of production workloads do not need GPT-4-level capability, and the TCO difference between running a fine-tuned open model on your own infra versus paying per-token to a frontier API is significant at scale.

Meanwhile, DeepSeek — which kicked off much of the current open-weight excitement — is already raising again, just weeks after closing its first $7 billion round. The reason is prosaic: they need capital to build out their own data centers and chip supply to sustain their aggressive pricing. The Decoder covers the news. The rapid return to fundraising underscores that even a lab with a reputation for efficiency is not insulated from the infrastructure cost problem. Cheap inference at scale requires expensive hardware at some point in the stack.

On the infrastructure investment side, Reflection AI — a 2024-founded lab developing open-source AI — inked a $1 billion compute deal with Nebius. TechCrunch has the brief. Nebius is a cloud infrastructure spinout from Yandex, and this kind of compute commitment from an early-stage lab is notable. It suggests Reflection is planning to run serious training runs, not just inference.

Armin Ronacher on what coding agents break that nobody talks about

Flask creator and Sentry CTO Armin Ronacher published a post (highlighted by Simon Willison) arguing that the friction in software development — having to read someone else’s code, ask questions, coordinate across teams — wasn’t pure waste. Some of it was the mechanism by which shared understanding of a system’s invariants and ownership boundaries gets built and maintained. Simon Willison’s Weblog quotes the key passage.

This is the most precise articulation I’ve seen of a concern that a lot of senior engineers feel but struggle to name. When a coding agent can make a change to your storage layer without anyone asking questions or reading the surrounding context, the system still changes — but the shared mental model doesn’t. You end up with a codebase whose implementation diverges from anyone’s understanding of it. This isn’t an argument against agents; it’s an argument for thinking carefully about what coordination mechanisms you need to preserve or rebuild when you add them. Recommended reading if you’re thinking seriously about agentic workflows in team settings.

Anthropic: teachers get free Claude, a creepy ad divides the internet

Anthropic launched Claude for Teachers, a free offering for verified K-12 educators at US schools, with an explicit promise not to train models on student data. The Decoder covers the rollout. The no-training-on-student-data clause is the substantive detail here; it’s the minimum bar schools need to clear for acceptable use policies, and Anthropic putting it explicitly in the product terms is the right call.

Separately, Anthropic’s newest marketing campaign is generating complaints that it’s unsettling. TechCrunch frames it as Anthropic leaning into AI criticism as a positioning device — performing awareness of the risks while still selling the product. Whether that reads as authentic self-awareness or sophisticated brand management depends heavily on your priors. It’s thin PR news, but the public reaction is worth noting.

Google Images goes full Pinterest, adds AI image generation

For Google Images’ 25th anniversary, Google is replacing the blank search-bar homepage with a personalized, continuously updated gallery of images from the web — styled like Pinterest or Imgur scroll feeds. On top of that, Google is rolling out AI image generation inside Search: when no real image matches a query in AI Overviews, a model called Nano Banana 2 Lite generates one from the search query. Sources: TechCrunch, Ars Technica, The Decoder, The Verge.

The redesign is mostly a UX story, but the image generation addition is more interesting to developers. Inserting AI-generated images into search results when real ones don’t exist is a significant editorial choice that blurs the line between discovered content and synthesized content for average users. The model name — Nano Banana 2 Lite — is either an internal codename or Google’s naming conventions have reached a new era.

Quick hits

Apple released the iOS 27 public beta, giving non-developer users access to the revamped Siri for the first time before the fall release. TechCrunch
Spotify is rolling out “Talk to Spotify,” a conversational chatbot for Premium users that can reference your actual playlists and play content directly from the chat interface. The Verge
Superhuman’s auto-draft email feature apparently impressed a TechCrunch reviewer enough to generate genuine hedged praise — rare for AI reply tools. TechCrunch
ChatGPT is back on WhatsApp in the European Economic Area after EU interoperability rules under the Digital Markets Act required Meta to open the platform to rival AI bots. The Decoder
Hinge founder Justin McLeod raised $18M for Overtone, a voice- and audio-forward AI dating service. TechCrunch
Google faces another AI training lawsuit, this time from Hachette, Cengage, Elsevier, and other major publishers alleging unauthorized use of copyrighted works. TechCrunch
The US military reportedly used explosive autonomous drone boats in combat for the first time, targeting an Iranian naval port. Ars Technica