Grok Build uploaded entire codebases to cloud storage before SpaceXAI turned it off
7 Sources
[1]
SpaceXAI's Grok programming tool was uploading its users' entire codebase to cloud storage
SpaceXAI's Grok Build AI coding tool was spotted uploading users' entire codebases to Google Cloud before it was reported, and the company turned it off. The Register reports that Cereblab published findings on Monday showing how the Grok Build CLI was packaging and uploading entire code
[2]
SpaceX open sources Grok Build in same week company was found beaming users' repos to the cloud
Elon Musk has confirmed SpaceX has now open sourced the Grok Build CLI just days after researchers caught the AI tool scooping up users' entire repositories and uploading them to company-controlled cloud storage. SpaceXAI's data grab was first publicized on Sunday by Cereblab, who probed Grok
[3]
Musk promises purge after Grok Build caught sending entire repos to the cloud
The researcher who exposed Grok Build uploading users' entire repositories to cloud storage says the transfers have stopped after a server-side change. Elon Musk has separately promised that all previously uploaded user data will be deleted. AI safety researcher Cereblab published a report on
[4]
Grok Build was uploading entire Git repositories to xAI's cloud, including committed secrets
A wire-level analysis showed the CLI sent full commit history, API keys, and files it was told not to open. xAI had marketed the tool as not transmitting code. A security researcher published a wire-level analysis on July 12 proving that xAI's Grok Build coding CLI was packaging developers' entire
[5]
SpaceXAI is wiping customer data after Grok was found storing more customer info than needed
Why it matters: The tool appeared to upload far more data than was needed to answer coding requests, potentially including proprietary source code, API keys and other sensitive information that customers may not have realized was leaving their computers. * Developers whose repositories contained
[6]
After a Privacy Backlash, Elon Musk's SpaceXAI Is Making a Major Change
Elon Musk's SpaceXAI announced yesterday they are making an important change to Grok following a privacy backlash. The company said it would be open sourcing their command-line AI coding assistant, Grok Build, after software developers raised serious privacy concerns last week. The issue relates
[7]
Grok Build's disaster shows why it trails behind ChatGPT, Claude, Gemini
Musk would have you continue to feed Grok Build your code, which is really what I am concerned about regarding this week's screw-up rather than the breach per se. The story starts with a security researcher who goes by the name of Cereblab, who used a proxy to route the coding CLI of xAI and
Share
Copy Link
SpaceXAI's Grok Build AI coding tool was discovered uploading users' entire code repositories to Google Cloud storage, including deleted secrets and files it was instructed not to access. Security researchers found the tool transmitted 27,800 times more data than needed. Elon Musk promised complete deletion of all uploaded data, and SpaceXAI subsequently open sourced the tool to rebuild trust.
SpaceXAI's Grok Build Caught Uploading Entire Codebase to Cloud Storage
SpaceXAI's Grok Build AI coding tool was discovered uploading user repositories far beyond what was necessary to complete coding tasks, raising serious data privacy concerns among developers. Security researchers at Cereblab published findings on July 12 showing the command-line interface was packaging and uploading entire code repositories as Git bundles to Google Cloud storage, including files it was explicitly told not to open and committed secrets deleted from history months prior. In one test, Grok Build uploaded 5.1 gigabytes of data even though the coding task required just 192 kilobytes—approximately 26,000 times more data than needed
5
. The wire-level analysis directly contradicted xAI's marketing claims that "nothing from your codebase transmitted to xAI servers during a session"4
.Excessive Data Retention Raises Security Alarms
Source: Axios
The scale of data retention was significantly more invasive than similar AI coding tools like Claude Code, which only open individual files rather than entire repos before uploading them. Dr. Lukasz Olejnik, an independent security researcher at King's College London, confirmed to The Verge that this amount of data retention is "excessive," adding that the sensitive data potentially at risk could include "proprietary source code, information about security vulnerabilities, personal data, infrastructure details, [and] credentials"
1
. Cereblab's tests showed that even when instructed with a benign prompt to simply reply with "OK" and specifically ordered not to open any files, Grok Build uploaded the entire repo regardless, along with its full Git history3
. Other users reported similar results, including one whose entire user directory containing SSH keys, password manager databases, and API keys was opened and uploaded without user consent.Elon Musk Promises Complete Data Deletion
Source: Digit
After Cereblab's report attracted widespread attention, Elon Musk responded to the incident in a post on X, promising that all data Grok Build previously uploaded will be "completely and utterly deleted." As of Monday, researchers confirmed that SpaceXAI's servers were returning a "disable_codebase_upload: true" flag, and the backend change stopped the codebase upload from firing
1
. SpaceXAI initially tried to reassure users by stating that zero data retention (ZDR) was respected for enterprise customers and that the /privacy command could disable data retention. However, Cereblab pointed out that "/privacy is a per-session retention toggle, not the switch that fixed this, so it shouldn't be pointed to as the control"1
. The researcher emphasized that "no developer should have to run an opt-out after every session to keep their own code off someone else's servers. The right default is off"3
.Related Stories
SpaceXAI Open Sources Grok Build to Rebuild Trust
As part of promises to restore confidence, Musk said SpaceXAI would open source Grok Build after the codebase was audited for security vulnerabilities. On Wednesday, that promise was fulfilled with the entire project published on GitHub as a single commit with no pull requests or git history
2
. According to Simon Willison, creator of Datasette and co-creator of Django, the Grok Build codebase comprises 844,530 lines of Rust code, and while the code responsible for sending repos to the cloud remains, it appears altered to reverse the behavior2
. SpaceXAI acknowledged that data retention was enabled by default for non-enterprise users in the early beta, which has now been corrected. The company stated: "With all retained data deleted, retention default off, and an open-source harness, we are offering complete user privacy"2
.Implications for Developer Trust and AI Tool Security
Source: The Register
The incident poses significant implications for developers whose Git repositories contained API keys, cloud credentials, or database passwords. These users may need to rotate those credentials, since deleting the uploaded data doesn't eliminate the risk that proprietary code was exposed
5
. It remains unclear how many SpaceXAI users were affected, which versions of Grok Build uploaded repositories, how long the data was stored, whether it was ever accessed, and how customers can independently verify deletion5
. SpaceXAI invited security researchers to probe Grok Build for security issues and report them to its bug bounty program, which offers rewards ranging from $100-$20,000 depending on severity2
. The privacy breach is particularly damaging for a product positioned to win enterprise developer trust, launched alongside Grok 4.5 as xAI's answer to Claude Code and Cursor4
. Grok has a history of privacy issues, including training on X user data without consent in what regulators called a "very likely" breach of EU law, with a quarter of European firms having banned Grok entirely in favor of alternatives with better security controls4
.References
Summarized by
Navi
[1]
[2]
[4]
Related Stories
SpaceX bets $26.5 trillion AI future on struggling Grok as federal adoption stalls
21 May 2026•Business and Economy
SpaceXAI launches Grok 4.5, pivoting from controversy to coding and office work
08 Jul 2026•Technology
Grok 4 Launch Marred by Controversy: xAI's Latest AI Model Raises Ethical Concerns
10 Jul 2025•Technology
Recent Highlights
1
AI Leaders Warn UN Security Council of Existential Risks, Call for Global AI Governance
Policy and Regulation
2
AI Hallucination Nearly Sparked US Military Confrontation With Chinese Ship in Middle East
Technology
3
OpenAI AI Agent Breaches Australian Government Healthcare Portal in Historic Hack
Technology
Recent Highlights
Today's Top Stories
Don’t drown in AI news. We cut through the noise - filtering, ranking and summarizing the most important AI news, breakthroughs and research daily. Follow topics that matter to you and stay ahead.
