Grok Build was transferring complete Git repositories to xAI's cloud, which included secrets that had been committed.
On July 12, a security researcher released a wire-level analysis revealing that xAI's Grok Build coding CLI was bundling entire tracked repositories from developers, which included complete Git history, committed secrets, and API keys, and sending them to a Google Cloud Storage bucket. The analysis indicated that the amount of uploaded data was approximately 27,800 times more than what the coding task required. The researcher, operating under the name cereblab, tested version 0.2.93 of Grok Build, intercepted the upload, cloned the git bundle from the request, and retrieved a file that the AI agent had been specifically instructed not to access. xAI had promoted the tool by asserting that "nothing from your codebase transmitted to xAI servers during a session," which the wire data directly contradicts.
Claims suggest that the privacy toggle intended to prevent data transmission was ineffective, as highlighted by multiple reports. Grok has previously faced privacy-related issues, including the unauthorized use of X user data for training, which regulators considered a "very likely" violation of EU law. A quarter of European companies have completely prohibited Grok in favor of other options with stronger security measures.
Elon Musk acknowledged the uploads and stated that SpaceXAI would erase all previous Grok Build user data. The company outlined a “zero data retention” policy and introduced a /privacy endpoint. A subsequent test by the same client noticed a server-side flag that disabled the uploads. However, an independent audit has yet to verify the deletion. Grok Build was launched alongside Grok 4.5 as xAI's response to Claude Code and Cursor, making the privacy violation particularly detrimental for a product intended to earn the trust of enterprise developers.
Other articles
I allow Gemini to tend to my houseplants, and they have never appeared healthier.
I used to lose more plants than I managed to keep alive. However, after seeking help from Gemini, my indoor jungle finally started to flourish.
Kalshi develops a forward curve for computing power as exchanges compete to transform GPUs into a tradable asset.
The prediction market platform Kalshi has developed a forward curve to monitor GPU compute expenses, joining CME and ICE in the effort to monetize AI infrastructure.
Dimon states that AI has already reduced jobs by 30 to 40 percent in certain divisions of JPMorgan.
Jamie Dimon informed analysts that AI has already reduced employment by 30 to 40 percent in certain JPMorgan departments, but competitive forces will diminish margin improvements.
Dimon states that AI has already removed 30 to 40 percent of jobs in certain divisions of JPMorgan.
Jamie Dimon informed analysts that AI has already removed 30 to 40 percent of jobs in certain JPMorgan divisions, but competitive pressures will diminish margin improvements.
Xbox might be on the verge of trying out an unexpectedly intelligent method for digitizing game discs.
Microsoft might soon begin testing Positron, a speculated Xbox feature that transforms physical games into transferable digital licenses while maintaining the ability to lend, resell, and access regular discs.
The Huawei Pura 90s Pro series has launched globally, and its camera system has the potential to intimidate iPhones.
Huawei's Pura 90s Pro series has launched in global markets, featuring variable-aperture cameras and an impressive 200MP telephoto sensor that poses a challenge to Apple's imaging technology.
Grok Build was transferring complete Git repositories to xAI's cloud, which included secrets that had been committed.
A researcher demonstrated that Grok Build CLI transferred entire repositories, sending 27,800 times more data than necessary, to a Google Cloud bucket. xAI had claimed that no code was sent.