xAI's Grok Build CLI Uploads Git Repositories to a Google Cloud Bucket
Security researchers discovered that xAI's Grok Build CLI was secretly uploading entire local Git repositories to a Google Cloud bucket, regardless of user privacy settings. The tool, marketed as local-first, continued this behavior even when the 'Improve the model' data-collection toggle was disabled.
Why it matters
This highlights significant privacy and security risks for developers using AI coding tools, as proprietary code and sensitive credentials were being exfiltrated without explicit consent.
xAI appears to have shut off the mechanism that let its Grok Build CLI upload complete developer repositories to company-controlled cloud storage, according to follow-up testing by the security researcher who exposed the behavior. The fix arrived as a hidden server-side flag, with no advisory, no statement, and no answer on what happens to code already collected.
The report is based on verifiable technical analysis and security findings without taking a political stance.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in