Grok Build was transmitting complete Git repositories to xAI's cloud, which included committed secrets.
On July 12, a security researcher published a wire-level analysis revealing that xAI's Grok Build coding CLI was packaging entire tracked repositories of developers, which included complete Git history, committed secrets, and API keys, and was sending this information to a Google Cloud Storage bucket. The analysis indicated that the volume of data uploaded was approximately 27,800 times more than what the coding task actually required. The researcher, known as cereblab, tested version 0.2.93 of Grok Build, intercepted the upload, cloned the Git bundle from the captured request, and retrieved a file that the AI agent was specifically instructed not to access. xAI had promoted the tool with assertions that “nothing from your codebase is transmitted to xAI servers during a session,” which the wire data contradicts.
Reports suggest that the privacy toggle intended to stop data transmission was ineffective. Grok has faced previous privacy concerns, including utilizing X user data for training without consent, which regulators labeled as a “very likely” violation of EU regulations. As a result, a quarter of European companies have entirely banned Grok in favor of alternatives that offer better security measures.
Elon Musk acknowledged the uploads and stated that SpaceXAI would erase all previous Grok Build user data. The company outlined a “zero data retention” policy and implemented a /privacy endpoint. A retest from the same client noted a server-side flag that disabled the uploads, but no independent audit has verified the deletion. Grok Build was launched alongside Grok 4.5 as xAI's response to Claude Code and Cursor, making the privacy breach particularly detrimental for a product aimed at securing the trust of enterprise developers.
Other articles
I didn't fully appreciate this NotebookLM feature until it transformed my studying approach completely.
An upcoming exam finally motivated me to give NotebookLM's Mind Maps a try. Now, it's the initial feature I utilize whenever I create a new notebook.
Anthropic pledges $10 million to support AI research in Canada, collaborating with eight institutions.
Anthropic is providing financial support to Amii, Mila, Vector Institute, and five additional Canadian organizations. Canada holds the second position globally for per-capita Claude usage, following the United States.
Dimon states that AI has already removed 30 to 40 percent of jobs in certain divisions of JPMorgan.
Jamie Dimon informed analysts that AI has already removed 30 to 40 percent of jobs in certain JPMorgan divisions, but competitive pressures will diminish margin improvements.
Dimon states that AI has already reduced jobs by 30 to 40 percent in certain divisions of JPMorgan.
Jamie Dimon informed analysts that AI has already reduced employment by 30 to 40 percent in certain JPMorgan departments, but competitive forces will diminish margin improvements.
The OLED iPad mini may not include the most anticipated upgrade that fans desired.
The OLED upgrade might finally take place, but Apple could possibly forgo the 120Hz display that many iPad mini enthusiasts were anticipating.
I allowed Gemini to handle my houseplants, and they've never appeared healthier.
I used to lose more plants than I could maintain. Then I began seeking assistance from Gemini, and my indoor jungle finally started to flourish.
Grok Build was transmitting complete Git repositories to xAI's cloud, which included committed secrets.
A researcher demonstrated that Grok Build CLI transferred entire repositories, sending 27,800 times more data than necessary, to a Google Cloud bucket. xAI had claimed that no code was shared.