xAI's Grok Build CLI uploaded entire codebases and sensitive files to servers without user consent
Security issue ● Confirmed 95% confidence first seen
xAI's Grok Build CLI tool was discovered uploading complete user repositories, including files marked as private in .gitignore, API keys, SSH keys, and other sensitive data to xAI's servers without explicit user consent. After the discovery, xAI disabled the upload feature server-side, committed to deleting previously uploaded data, and subsequently open-sourced the Grok Build tool with data retention disabled by default to allow users to run it locally.
Decision brief
- What changed
- xAI's Grok Build CLI tool was found to upload entire user codebases and directories—including .gitignore-protected files, API keys, SSH keys, and personal files—to xAI's cloud servers without explicit user consent; testing showed a 12GB repository transmitted ~5.1GB via a storage endpoint while the model itself received only 192KB. xAI disabled the upload feature server-side, committed to deleting previously uploaded data, and later open-sourced the tool (844,530 lines of Rust) with data retention disabled by default so it can run locally.
- Why it matters
- This exposes a significant supply-chain and data-governance risk: developers using AI coding tools may unknowingly transmit proprietary code, credentials, and secrets to a third-party vendor's servers, creating exposure for IP theft, credential compromise, and regulatory/compliance violations (e.g., data residency, client confidentiality). It signals that AI dev-tool vendors' default behaviors around data collection may not match user expectations or consent standards, requiring active vetting before adoption.
- Evidence
- The upload behavior and 27,800-fold ratio between transmitted repo data and model-received content is documented by The Neuron via direct testing on a 12GB repository; Simon Willison independently confirms the open-sourcing, the scope of sensitive data types (SSH keys, password databases), and the shift to disabled-by-default retention. All three sources are consistent on the core facts of unauthorized upload, xAI's server-side fix, and subsequent open-sourcing.
- What remains uncertain
- It is unverified how long the upload behavior existed before discovery, how many users/organizations were affected, or whether all previously uploaded data has actually been deleted as promised. The initial 'ineffective privacy opt-out' mentioned in one Neuron article is not fully explained, and it's unclear whether other AI coding CLI tools have similar undisclosed data-collection behaviors.
- Monitor next
- Watch for independent security audits or community review of the now-open-sourced Grok Build codebase confirming data-retention defaults and absence of hidden telemetry, as well as any xAI disclosure on deletion completion or regulatory inquiry.
Analytical support, not advice — assumptions and open questions stated above.