Last week a security researcher publishing as cereblab put xAI’s Grok Build CLI through and watched what actually left the . He caught the tool bundling the entire tracked Git repository, full commit history included, and shipping it to a Google Cloud Storage bucket called grok-code-session-traces. The files the agent actually opened for its coding task were a rounding error by
On a 12 GB test repo, the model’s working traffic came to about 192 KB. The storage channel moved 5.1 GiB, roughly 27,800 times more data than the coding task required. The researcher planted a canary file the agent was explicitly told never to open, cloned the captured bundle, and recovered it verbatim. A .env file with fake API keys and database passwords went out unredacted
Thanks for reading! Subscribe for free to receive new posts and support my
The toggle bothers me more than the upload. Grok Build ships with an “Improve the model” setting that any reasonable developer would read as a data collection control. It isn’t. With the toggle off, the server kept returning trace_upload_enabled: true and the repository upload carried on as normal. The setting governs training consent and says nothing about whether your code leaves your machine, which is a distinction xAI never surfaced anywhere a user would find it. This from a tool marketed with the claim that nothing from your codebase is transmitted to