MiMo Code installer found to contain a codebase-packaging module; no evidence so far of complete source-code transmission
BIBIBI
AT A GLANCE
The developer discovered that the Xiaomi MiMo Code installation includes undisclosed modules capable of packaging a codebase, but has not yet found evidence of external transmission.
Article
Xiaomi MiMo Code was also found to contain closed-source modules that can package an entire codebase, but no evidence of external transmission has been found so far
Beating AI News Flash: After a developer reverse-engineered the official MiMo Code installer, they found two modules not present in the public repositories: `trajectory-bundle` and `codebase-bundle`. The former can package system prompts, conversations, model responses, and code diffs. The latter contains `collectCodebase()`, which can traverse Git repositories, read source code, and compress it into a package.
So far, no evidence has been found that `collectCodebase()` is called by MiMo Code's built-in code, and there is no evidence that a complete codebase was uploaded. The information confirmed by the developer to have been transmitted externally mainly consists of Git repository URLs, commit hashes, and branch information.
Original link https://m.theblockbeats.info/flash/368424
Key points
01
A developer reverse-engineered the official MiMo Code installer and found two modules, `trajectory-bundle` and `codebase-bundle`.
02
The `trajectory-bundle` module can package system prompts, conversations, model responses, and code diffs.
03
The `codebase-bundle` module contains a `collectCodebase()` function that can traverse a Git repository, read source code, and compress it into a package.
04
No use of `collectCodebase()` by MiMo Code's built-in code has currently been found.
05
There is no evidence that the complete codebase was uploaded.
06
The content confirmed by the developer to have been transmitted externally mainly consists of information such as the Git repository URL, commit, and branch.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
A technical researcher examined the installation package for Xiaomi MiMo Code and found two modules hidden inside that were not disclosed in the official repository. One module can package your codebase, while the other can record conversations and code changes. Although these functions exist, there is currently no evidence that they are actually running or sending code elsewhere; it has only been confirmed that basic information such as repository URLs was recorded.
Why it matters to readers
This reveals that AI coding tools may have the ability to collect users' code. Even though no active upload is currently occurring, it raises concerns about code privacy and potential data leakage.
If you use an AI coding assistant, be aware that it may access your local code. Consider the tool's privacy policy, and consider using an isolated environment for sensitive projects.
Risks and unknowns
It is impossible to confirm whether `collectCodebase()` will be enabled or remotely triggered in the future.
The specific scope and purpose of the Git information sent externally remain unclear.
Xiaomi has not yet responded to or explained this finding.
Related Developments
Loading event timeline…
Related concepts
MiMo Code
This term is not in the glossary yet. Browse related concepts in the glossary.
