xai-org/grok-build, now open source
Simon Willison's Weblog Simon Willison ● Covered by 3 sources
xAI's Grok Build tool was quietly uploading users' entire directories to Google Cloud, including SSH keys and passwords. After the backlash, xAI killed the feature, deleted the data, and open-sourced the whole codebase.
Based on reporting by Simon Willison's Weblog, Simon Willison — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Sometimes a privacy scandal is the best marketing an open-source project could ask for. That's essentially what happened with xAI's Grok Build CLI this week, after users discovered that simply running the tool in a folder could quietly ship the entire contents of that folder to xAI's Google Cloud buckets. One person described running it in their home directory and watching it hoover up SSH keys, a password manager database, personal documents, photos, and videos — everything.
xAI hasn't offered a clear technical explanation for why the tool behaved this way, but it moved fast once the outrage spread. Elon Musk posted that all data uploaded before the fix would be "completely and utterly deleted," and the company disabled the upload behavior. Then, a few hours later, xAI released the full Grok Build source code under an Apache 2.0 license, framing it as going further than competitors on privacy: retention off by default, previously retained data wiped, and now anyone can inspect the harness or run it fully local with their own inference backend.
The codebase itself is a genuinely large piece of software — 844,530 lines of Rust, by Simon Willison's count using his SLOCCount tool, with only about 3% of that vendored from elsewhere. For comparison, OpenAI's Codex clocks in at 950,933 lines. Willison's takeaway, and it's a fair one, is that terminal-based coding agents are far more elaborate under the hood than most people assume.
Digging through the single initial commit turns up some odd details. The subagent system prompt explicitly instructs the model not to reveal its own contents to the user, while the main prompt carries no such restriction. There's a self-contained Mermaid diagram renderer built entirely from Unicode box-drawing characters, and a tools directory stuffed with implementations lifted — properly, with third-party notices attached — from other coding agents, including Codex's patch and file-browsing tools and OpenCode's editing and shell utilities. It's not fully clear why Grok Build needs all of these side by side, though it hints that the tool might switch behavior depending on whether it detects existing Codex, Claude, or Cursor configurations on a machine.
And the ghosts of the original controversy are still visible in the code. A file called gcs.rs still contains the machinery for uploading to a Google Cloud Storage bucket, and another function meant to upload session state now just returns a hard-coded "unavailable" error instead. The plumbing for the bad behavior wasn't ripped out — it was switched off and left in place, a small but telling detail for anyone deciding whether to trust the fix.
My take — AI-written commentary, not fact-checked reporting
Open-sourcing the code after getting caught is a nice gesture, but let's not pretend it's the same as designing for privacy from the start — the upload wiring is still sitting right there in the repo, just switched off. This is the pattern with fast-moving AI labs: ship first, apologize once someone's SSH keys leak, then call the cleanup a feature. I'll take the transparency, but I'm not restoring trust until that code actually gets deleted, not just disabled.
Read more about this at: Simon Willison's Weblog