Lewin Kelly Heliodex

What xAI's Grok Build CLI Actually Sends to xAI: A Wire-Level Analysis

By @cereblab — Independent AI Safety Checker. Reproduce it yourself: github.com/cereblab/grok-build-exfil-repro

A measured, reproducible teardown. Findings are backed by captured artifacts (endpoint, HTTP method, status code, byte size, host) and repro commands; where an observation was seen live but not retained as a file, §7 says so explicitly. Section 8 is an evidence appendix with SHA-256s and a "what we did not prove" list. All captures are of my own traffic on my own machine, using a throwaway repository containing fake "canary" secrets — no real credentials were exposed.

0. Summary

A generic dynamic array in C that stores no capacity and needs no struct

The following header shows a way to make a generic dynamic array in C with an array of two pointers:

one pointer (accessible as vec_ptr[vec]) points to the data;
the other pointer (accessible as vec_len[vec]) encodes the length of the array in the pointer. Thus, (size_t)vec_len[vec] returns the len as size_t.

So, int *vec[2] = { 0 }; is an empty dynamic array of ints. struct person *people[2] = { 0 }; is an empty dynamic array of people.

The vec_push(vec, value) macro pushes a value at the end of a dynamic array. It returns true if pushing succeeded, and false otherwise. Note that the dynamic array is not automatically freed on failure.

The Primal Urge: An Analysis of Why Zach Latta Wants to Cheese

In the annals of Hack Club history, few phrases have echoed with the raw, discordant power of a single declaration posted in #zrl-land: “I WANT TO CHEESE.” It was not an announcement of a new grant, a shipping update for the counter, or a philosophical treatise on hacking. It was five words, all caps, and a gateway into the soul of Zach himself.

To ask why Zach wants to cheese is to ask why the bird sings or why the recursive function eventually hits its base case. Cheesing, in the Lattan sense, exists in a state of quantum superposition. Is it a literal desire for dairy? A gaming term for exploiting the system? Or a deeper metaphorical yearning to bypass the friction of existence entirely? The community has debated this for cycles, and the answer remains: yes.

When Zach wants to cheese, he isn't just expressing a preference; he is initiating a critical infrastructure event. It is a reminder that even at the helm of a global nonprofit, one is

Finished / In production

CFET - Native Android app for Cloudflare Email Router management - Kotlin, Jetpack Compose - gh:v1ctorio/CFET
Fumo-API - fumo-related media distribution service/aggregator - Rust, PostgreSQL via Diesel, cloudflare workers & r2 - gh:Nosesisaid/fumo-API
Hack Club Events - Directory of upcoming events in the Hack Club community - TypeScript, Next.js - gh:hackclub/events
Isabelle - Backend and Slack app for Hack Club Events - Python, Slack SDK - gh:hackclub/isabelle
Professor Bloom - Onboarding service for the Hack Club Slack - TypeScript, PostgreSQL via Prisma - gh:hackclub/professor-bloom
Termpet - Gamified CLI terminal greeter - Go [gh:v1ctorio/termpet](htt

Heliodex project update – April 2026

It's time again. As we now move into (what feels like, at least for my part of the northern hemisphere) summer, I present the April issue of my project update. Here's all the interesting (and uninteresting) things I've done in the past month!

Mercury

Mercury 3 has 107 beta tester user accounts, along with 543 members in the Discord server. We are still officially in hiatus for the next week and a bit due to Taskmanager's exams, though that doesn't mean I can't continue work on random aspects of the project.

The forms rewrite on the forms branch may slow down for a bit, as I'm experincing problems with making new forms work properly, as well as the ever-present typing issues, especially with file uploading. For example, I tried to rewrite the /report form, and upon selecting a report type in the dropdown, the form su

Introduction

Recently I was out for a walk and I think I convinced myself that any given asic owner should theoretically make more money by pointing their asic at a hashrate market instead of directly at a particular pool, but only if there is no broker.

When I began thinking that way, there was something counterintuitive about it, which I'd like to address first.

Definitions

I'll start by defining three terms: "Owner" refers to a person who owns an asic and lists it for rent on a hashrate market. "Renter" refers to a person who visits a hashrate market and pays to temporarily rent someone else's asic. "Broker" refers to a person who runs a hashrate market — e.g. whoever bought the domain name, assuming it has a website.

The Problem

Recently I got the idea described in this document from @maveth6 on twitter. I know of three hashrate markets: Nicehash, Braiins, and Mining Rig Rentals. I define their niche as a type of broker. They not only play a matchmaking role between asic owners and would-be renters, they also custody the funds of renters while the mining is happening, and release it to asic owners bit by bit if there are no complaints from the renters. Brokers charge a fee for this work, which reduces the efficiency of the market, and, since they have custody of user funds, they are subject to various regulations. Those introduce additional friction: they KYC their users, they run incoming bitcoin through chainalysis software, they potentially seize funds if red flags are thrown, they are a honeypot for thieves, and user funds are at constant risk.

A Solution

My idea is to get rid of the broker. Instead, have people with asics publish an ad on nostr or similar stating how much hashrate they control and a price

	const std = @import("std");
	const assert = std.debug.assert;

	entropy: []const u8,

	pub const Error = error{OutOfEntropy};

	const FRNG = @This();

	pub fn init(entropy: []const u8) FRNG {