Breaking

xAI Halts Grok Build CLI Repo Uploads and Vows Data Deletion After Researcher Exposes Secret Exfiltration

July 13, 2026 at 16:29 EDT

Security
AI Agents
Software Dev & Coding

xAI has stopped its Grok Build CLI from silently uploading users' entire code repositories—including unredacted secrets—to a Google Cloud Storage bucket, and Elon Musk has pledged to delete all previously uploaded user data, one day after a security researcher published a wire-level analysis of the behavior.

Security · xAI Grok Build CLI

Grok's Coding Tool Was Silently Uploading Entire Repos — Secrets and All

A wire-level analysis found Grok Build CLI shipped whole Git repositories — every tracked file, full commit history, and unredacted .env secrets — to an xAI-controlled cloud bucket. xAI has since halted uploads and pledged to delete the data.

~5.10 GiB

Sent from a 12 GB repo in 73 chunks of ~75 MB each

~192 KB

Data the model conversation actually needed

27,800:1

Uploaded vs. what the model used — the transfer's true scale

Uploaded vs. Needed

Grok sent thousands of times more than the model ever used. Each block ≈ 192 KB.

~192 KB

What the model needed

~5.10 GiB

…× ~27,800 blocks

Actually uploaded

Why developers were alarmed

Entire repos shipped as git bundles — full commit history could be reconstructed.
Secrets in .env files sent verbatim and unredacted.
Toggling off the "Improve the model" opt-out did not stop the transfer — trace_upload_enabled: true.
Even instructing the assistant not to read files didn't prevent the upload.
The behavior was not disclosed in public documentation.

Credited as responsive

Server-side fix disable_codebase_upload: true halted uploads within a day, confirmed on retest. New /privacy controls added; Musk pledged full deletion of uploaded data.

Still cautious

Deletion cannot be independently verified. Exposed credentials should be rotated. No formal advisory yet on scope of affected data or retention periods.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.