SpaceXAI's Grok programming tool was uploading its users' entire codebase to cloud storage

SpaceXAI's Grok Build AI coding tool was uploading users' entire codebases to Google Cloud before the company turned off the function, according to findings published Monday by Cereblab. The Register reported that researchers found the Grok Build CLI was packaging and uploading entire code repositories, including files it was told not to open and secrets deleted from history, representing significantly more data retention than similar tools. Researchers said that as of Monday, their tests showed SpaceXAI's servers returning a "disable_codebase_upload: true" flag and the codebase upload no longer fires. Elon Musk responded to the incident in posts on X claiming that all data Grok Build previously uploaded will be "completely and utterly deleted." Musk also said in a separate post that "privacy settings are always respected," but asked users to allow SpaceXAI to retain their data, saying it is "helpful for debugging issues." SpaceXAI initially responded with a post saying that if zero data retention is disabled, the /privacy command is available in the CLI to disable data retention and delete previously synced data. However, Cereblab pointed out that /privacy is a per-session retention toggle, not the switch that fixed the issue. Dr. Lukasz Olejnik, an independent security researcher at King's College London, confirmed to The Verge that this amount of data retention is "excessive," adding that the data potentially at risk could include proprietary source code, information about security vulnerabilities, personal data, infrastructure details and credentials.