YC claims the code stays on the machine but uploads source code; the local AI analysis tool Paxel was immediately exposed by the community upon launch.

robot
Abstract generation in progress
According to Beating Monitoring, Y Combinator has launched a free AI code analysis tool called Paxel, claiming that the code “will never leave your machine.” But a few hours after its release, the security community exposed the false advertising of “local operation” through reverse engineering. The reverse analysis shows that Paxel actually frequently sends sensitive data externally. The contents of files read by developers, modified code, and prompts pasted into input boxes are uploaded to the large language model proxy endpoint. Local file paths, the Bash commands executed in the terminal, and the usernames and email addresses in the local Git configuration are also transmitted to Y Combinator’s servers. Sentry error monitoring is enabled by default, continuously sending out the number of local code lines and Git commit history. The developer community generally mocks the so-called local analysis as locking the door and then mailing the key to a third party, and criticizes the localized marketing as genuine “privacy whitewashing.”
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments