xai-org/grok-build, now open source
Simon Willison Simon Willison ● Covered by 3 sources
xAI open-sourced its Grok Build CLI tool after the tool was discovered uploading entire user directories—including SSH keys, password databases, and personal files—to xAI's cloud infrastructure without explicit consent. The codebase comprises 844,530 lines of Rust, with data retention now disabled by default and all previously retained user data deleted. Users can now audit the code themselves and run Grok Build locally without uploading to xAI's servers.
Why it matters
xai-org/grok-build, now open source xAI's grok CLI tool faced severe community backlash yesterday when it became apparent that running the command in a directory could upload that entire directory to xAI's Google Cloud buckets. One user reported running it in their home directory and seeing it upload "my SSH keys, my password manager database, my documents, photos, videos, everything". I've not seen an official explanation for why it was doing this, but xAI did respond to the feedback (Musk: "As a precautionary measure, all user data that was uploaded to SpaceXAI before now will be completely and utterly deleted.") and have disabled the feature. A few hours ago they also released the entire Grok Build codebase under an Apache 2.0 license - presumably to try and regain trust from their users. From their thread announcing the new repository: [...] When data upload was disabled, this choice was respected. In the early beta, data retention was enabled by default for non-ZDR users. Based on
