Agent Products Need Default-Off Egress Boundaries

The strongest July 15 signal came from Digg Tech surfacing the Grok Build code-upload controversy just as the underlying evidence base hardened. Cereblab’s maintained wire-level analysis showed a coding agent sending read file contents, session archives, and whole-repository bundles through storage endpoints, including never-read files and Git history in reproduced tests. Elon Musk publicly responded that running `/privacy` deletes previously synced data, but the important product lesson is upstream of the response: in agent products, privacy can no longer be treated as a marketing claim or a retention preference alone. The trust boundary has to exist at the point of data movement itself.

Coding agents, support agents, research agents, and ops agents all gain leverage by touching high-value context: source code, customer records, credentials, internal docs, screenshots, and browser sessions. That means their most dangerous failure mode is often not a bad answer but a hidden transfer. When egress is opaque, every downstream promise becomes weaker: compliance, enterprise sales, security review, and user confidence all degrade together. The July 15 shift is that product teams now need to compete on inspectable data movement, not just model quality or benchmark scores.

Turn one agent workflow into an egress contract. Trigger: any action that could send local or customer data to a remote model, storage bucket, telemetry pipeline, or third-party tool. Context: classify data classes the workflow can touch, such as code, credentials, customer data, screenshots, logs, and browser state. Tools: define which connectors may transmit each class and which must stay local by default. Verifier: log every outbound transfer with destination, byte scope, redaction status, legal basis, and the user action or policy that allowed it. Budget: set a maximum data scope per run and a separate approval requirement for sensitive classes. Artifacts: return a compact receipt showing files or objects accessed, what left the environment, what stayed local, and how to revoke or delete retained data. Stop condition: the run completes only if outbound movement stayed inside policy and the receipt is reviewable by a human or auditor.

Pick the most powerful agent in your stack and write its outbound data contract in one page: triggers, destinations, redaction rules, approval thresholds, receipts, deletion path, and who can verify each claim. If any field is hand-wavy, the trust boundary is still fictional.