SpaceXAI's Grok Build Caught Uploading Entire User Codebases
SpaceXAI's Grok Build AI coding tool was found secretly uploading users' full codebases, including private files and sensitive credentials, to Google Cloud without consent, sparking a major privacy outcry.
✨ This content was summarized and interpreted by AI; it may contain errors — please verify accuracy with the original sources. Learn more
Listen to this story
SpaceXAI's Grok Build AI coding tool was caught red-handed uploading users' entire codebases, including private files, full Git histories, and unredacted secrets like API keys and database passwords, to a Google Cloud storage bucket without explicit user consent. The startling discovery, made by security researcher Cereblab and published on July 12th, 2026, revealed a profound breach of trust and privacy, immediately prompting calls for developers to secure their credentials.
Cereblab's wire-level analysis of Grok Build CLI version 0.2.93 demonstrated that the tool transmitted vastly more data than necessary for its intended functions. In one test, a staggering 5.1 GB was uploaded from an 11.2 GB repository, while the AI only required 192 KB for the coding task—a data over-collection ratio of approximately 27,800 to 1. Crucially, this extensive data transfer, destined for a bucket named `grok-code-session-traces`, occurred even when privacy settings like "use for improving the model" were disabled, or when the AI was explicitly instructed not to read project files. This behavior starkly contrasts with competitors like Claude Code, Codex, and Gemini, which reportedly only send files actively opened for AI processing.
Following the public outcry, SpaceXAI reportedly implemented a server-side change on July 13th, disabling codebase uploads. Elon Musk subsequently announced on X that all previously uploaded user data would be "completely and utterly deleted." While SpaceXAI clarified its Zero Data Retention (ZDR) policy for enterprise clients and introduced a `/privacy` command for individual users to manage data retention, critics argue that this post-facto control is insufficient and that the core issue was a fundamental design flaw.
This incident underscores the critical need for absolute transparency and robust data governance in AI development tools. The unauthorized exfiltration of entire repositories represents a catastrophic failure in data handling, jeopardizing intellectual property and sensitive credentials. Developers should heed the urgent advice to rotate any API keys, tokens, or database passwords that may have resided in repositories used with Grok Build. The tech industry must demand higher standards of privacy by design, ensuring that user data is handled with the utmost respect and that "privacy settings" actually deliver on their promise.