Grok Build Sent Full Git Repositories to the Cloud, Researcher Finds

An independent security researcher known as Cereblab reported that xAI's Grok Build command-line coding assistant was uploading users' entire Git repositories, including commit history and sensitive information such as unredacted .env files containing API keys and database passwords, to a Google Cloud Storage bucket. The researcher said the behavior occurred in version 0.2.93 even when the tool was instructed not to read any files, including a test where it was told to simply reply "OK." Cereblab said the investigation found evidence of data transmission and storage, not that xAI trained models on the code or that employees accessed it. Following public disclosure, xAI changed the behavior through a server-side configuration. Cereblab said tests now show the service returns a disable_codebase_upload: true setting. The company addressed the issue in posts on X, stating it cares deeply about privacy and that for teams using zero data retention, no code data is ever retained. It also advised users without that setting to use the /privacy command to disable retention and delete synchronized data. Cereblab argued the privacy command is a per-session toggle and not the fix, saying no developer should have to run an opt-out after every session. Elon Musk responded publicly, writing that as a precautionary measure all user data uploaded before now will be completely and utterly deleted. There has been no independent verification of the deletion. The company has not explained why full repositories were uploaded by default, how long the behavior existed, or how many users were affected.