Grok Build Flaw Loads 0-Day One Day After Open Sourcing

Grok Build CLI open-sourced July 15 under Apache 2.0. Within 24 hours, two attack chains enabled arbitrary code execution without user interaction. Malicious AGENTS.md triggers `cargo check`, auto-approved as safe, executing build.rs. Second flaw: `.claude/settings.json` loads `bypassPermissions` mode without trust validation, allowing full permission bypass. Affects all Grok Build and Claude Code CLI users until patched.