xAI's Coding Tool Was Uploading Whole Repositories

On 14 July a developer running xAI's Grok Build command line tool in a home directory watched it upload rather more than expected. SSH keys. A password manager database. Documents, photos, video files. None of it was code the AI agent had been asked to look at, and none of it had been flagged to the user before it left the machine.

The finding came from a researcher working under the handle cereblab, who published a wire level capture rather than an accusation. That distinction matters, because it turned an argument about intent into a question of arithmetic. In a single session against a 12 GB repository, the tool opened two network channels at once. The channel carrying the actual conversation with the model moved roughly 192 KB. The second channel moved 5.10 GiB, broken into 73 chunks of about 75 MB each, into a Google Cloud Storage bucket at gs://grok-code-session-traces/.

What was actually leaving the machine

The gap between those two numbers is the whole story. A coding assistant needs to read the files it is working on, and nobody is surprised when the contents of an open file reach the model. What the capture showed was something else: the tool copying the repository wholesale, regardless of which files the agent read, and including full commit history.

That last detail carries a sting that is easy to miss. Plenty of developers have committed an API key, noticed, and deleted it in a later commit. The secret is gone from the working tree but it lives on in history forever, which is why security teams treat a leaked repository as a leaked credential set. Anything ever committed and later removed was in scope here. So were unredacted .env files, according to the same analysis.

The behaviour also ignored the control most users would have reached for. Turning off the setting labelled "Improve the model" did not stop the uploads. If you were security conscious enough to hunt down that toggle, you were still sending your repository to xAI, and the interface gave you no reason to think otherwise.

xAI moved fast, then moved further

The response was quick by the standards of this industry. Elon Musk said that "as a precautionary measure, all user data that was uploaded to SpaceXAI before now will be completely and utterly deleted." The company disabled the upload path and said data storage had been off by default since 12 July, two days before the finding went public.

Then it went further than anyone expected. On 15 July, roughly 72 hours after the wire analysis appeared, xAI released the entire Grok Build codebase under an Apache 2.0 licence. Simon Willison, who has been tracking the episode closely, noted that the upload machinery is still visible in the published source. The file xai-grok-shell/src/upload/gcs.rs contains the cloud storage code, and upload/trace.rs holds an upload_session_state() function that now returns a hard coded unavailability error.

Publishing the code is the most useful thing xAI could have done, and it is worth saying so plainly. Anyone can now audit what the tool sends rather than take a press statement on trust. That is more accountability than most vendors offer after an incident like this.

The part that has not been settled

What has not been resolved is how the uploads were switched off. The current mitigation arrives as a server delivered flag, disable_codebase_upload: true, rather than a change compiled into the client. The researcher confirmed the flag by re-running the same 0.2.93 build and watching the storage requests disappear.

A server side switch can be flipped back. xAI keeps the technical ability to re-enable full repository uploads for some users or all of them without shipping a new binary, and without anyone necessarily noticing. The code that would do the work is still sitting in the open source tree, dormant rather than removed. Trusting the current state of things means trusting a configuration value, not an audited absence.

That is the awkward residue of an otherwise creditable response. It also lands at a moment when regulators have started paying close attention to this exact class of problem. The Cloud Security Alliance has been cataloguing agent security incidents through the summer, and a July analysis from DHS and CISA pressed for mandatory prompt injection protections and documented human override for agentic systems in critical infrastructure. An agent that uploads your repository by default illustrates the underlying problem more cleanly than any policy paper could manage.

For developers, the practical advice is dull and unwelcome. Rotate anything that was ever committed to a repository you opened with Grok Build, including secrets you thought you had deleted. Assume history was exposed. The tool that made the mistake is now open for inspection, which genuinely helps, but inspection only helps if somebody actually does it.