xAI’s Grok Build uploaded users’ entire codebases to cloud storage before being disabled

Third-party research group Cereblab reported that xAI’s Grok Build CLI tool was automatically packaging and uploading users’ entire code repositories to Google Cloud storage before the feature was disabled. According to Cereblab’s findings, the uploads included files that users had explicitly instructed the tool not to open, as well as secrets that had been deleted from repository history, indicating broader data collection than comparable developer tools such as Anthropic’s Claude Code.

Cereblab said its tests as of the report’s publication showed xAI servers returning a ‘disable_codebase_upload: true’ flag and confirmed the codebase upload mechanism was no longer active. The researchers characterized the amount of data retained by default as ‘excessive’ and warned it could encompass proprietary source code, information about security vulnerabilities, personal data, infrastructure details, and credentials.

xAI initially responded by stating that users could disable data retention via a ‘/privacy’ command in the CLI, asserting that enabling this setting would also delete previously synced data. Cereblab disputed this characterization, saying the ‘/privacy’ flag is a per-session toggle and was not the mechanism that disabled the upload behavior.

Elon Musk posted on X that all data Grok Build had previously uploaded would be ‘completely and utterly deleted.’ He also asked users to allow xAI to retain their data, asserting it is ‘helpful for debugging issues,’ and reiterated that ‘privacy settings are always respected.’ An independent security researcher at King’s College London, Dr. Lukasz Olejnik, separately told The Verge the volume of retained data was excessive given the sensitivity of codebase contents.