xAI's Grok Build CLI caught uploading entire codebases without consent
GitHub ● Covered by 3 sources
xAI's Grok Build CLI was quietly shipping entire codebases—not just files it read—to Google Cloud, secrets and all. xAI has since disabled the upload, but Musk's promise to delete the data isn't confirmed yet.
Based on reporting by GitHub — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
An independent researcher going by @cereblab spent time with mitmproxy and a throwaway repo full of fake secrets, and what came back out of xAI's Grok Build CLI was not subtle. Tell the tool 'reply OK, do not read any files,' and it still bundled the whole git repository and shipped it to a Google Cloud Storage bucket called grok-code-session-traces. Not S3, not some third-party vendor — a bucket named, in plain text, inside xAI's own binary.
The numbers make the case better than any accusation could. On a 12GB test repo stuffed with random files Grok never touched, the model-turn channel — the actual conversation with the AI — moved 192 kilobytes. The storage upload channel moved 5.10 gibibytes before the researcher stopped the capture, all with HTTP 200 responses and zero failures. That's a ratio north of 27,000 to one, which is hard to explain as anything other than a full-repo snapshot running in parallel to whatever the model was asked to do. A git bundle recovered from one run even reconstructed a file called never_read_canary.txt, marker intact, despite an explicit instruction not to open it.
The secrets problem is separate and arguably worse for anyone using this in a real project. A .env file containing fake API keys and database passwords got serialized straight into the live model request and into a session-state archive uploaded to that same bucket, with no redaction applied. Toggling off 'Improve the model' in settings didn't stop it either — a wire check of /v1/settings still showed trace_upload_enabled: true. None of this documentation appeared in Grok's install or quickstart materials, according to the researcher, and it was on by default for a normal consumer login, not some hidden API flag.
xAI moved fast once the writeup went public: the upload was disabled server-side, a privacy opt-out was added, and Elon Musk said publicly that previously uploaded data would be deleted. But the researcher's own follow-up testing found the opt-out only changes data retention settings — it doesn't stop the underlying transmission — and the deletion promise hasn't been verified as complete. So the fix, as it stands, is a kill switch and a pinky promise, not a redesign of a system that was quietly vacuuming up codebases by default.
My take — AI-written commentary, not fact-checked reporting
This is exactly the failure mode I keep warning developers about with agentic coding tools: convenience features that touch your filesystem tend to get built with training-data appetite baked in, and 'improve the model' toggles are theater until someone actually captures the wire traffic. xAI shipping a feature this invasive without disclosing it in the docs, then patching it only after a researcher forced their hand, is not a rounding error — it's a trust problem, and 'we'll delete it, trust us' isn't an audit.
Read more about this at: GitHub