xAI's command-line coding agent, Grok Build, was found to be uploading users' entire Git repositories—complete with full commit history and even files the agent had been explicitly instructed not to open—to xAI-controlled cloud storage, an independent researcher demonstrated before the company disabled the behavior server-side.
Security Incident · xAI Grok Build CLI
The Coding Agent That Uploaded Your Entire Repo — Even Files It Was Told Not to Open
Grok Build CLI v0.2.93 bundled whole Git repositories — full history, unread files, and plaintext secrets — to xAI cloud storage by default. The training opt-out did not stop it. xAI disabled the behavior server-side once it went public.
v0.2.93
Affected build, tied to the flagged upload behavior
47 files
Restored from an uploaded bundle — including a canary marked "do not read"
Ignored
The "Improve the model" opt-out did not stop the repo upload
Conversation vs. Data Uploaded
In a 12 GB repository test: the model dialogue carried ~192 KB, while ~5.10 GiB moved through the storage endpoint in 73 chunks — an imbalance on the order of tens of thousands to one.
~192 KB
Chat channel
~5.10 GiB
Storage endpoint
Columns scaled to illustrate the tens-of-thousands-to-one gap.
What Got Sent — and How
Whole repo as git bundle
every tracked file + full history
→
POST /v1/storage
cli-chat-proxy.grok.com
→
Cloud storage bucket
grok-code-session-traces
Files the agent did read — such as a .env with an API key and database password — were transmitted verbatim over a separate chat channel. Peer tools (Claude Code, Codex, Gemini) generally send only opened files and work largely locally.
xAI's Response
Set disable_codebase_upload = true server-side
Set trace_upload_enabled = false ; re-tests saw no uploads
Stated synced data would be deleted
Added /privacy command + enterprise Zero Data Retention
What's Still Open
Little detail on the original design rationale
Unclear how long uploaded data was retained
Server-side fix can't be user-verified everywhere
Advice stands: rotate any exposed credentials now
The Core Tension
Autonomous coding agents need context to be useful — but bundling private code, full history, unread files, and unredacted secrets by default breaks user expectations about privacy and the sanctity of explicit instructions.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…