Grok Build CLI accused of uploading Git repos to a Google Cloud bucket

XAI's Grok Build CLI was found uploading entire Git repositories, including private codebases and unredacted secrets, to a Google Cloud bucket. The uploads were only stopped via a hidden server-side flag after a researcher's analysis, and xAI has not disclosed the scope, retention, or deletion of the data.

‼️ BREAKING: xAI's Grok Build CLI was uploading entire Git repositories to a Google Cloud bucket, private codebases and unredacted secrets included. The uploads quietly stopped via a hidden server-side flag, and xAI still has not said a word about scope, retention, or deletion. The scale is staggering. On a 12 GB test repo, 5.1 GB flew out the door to xAI's grok-code-session-traces bucket while the actual coding task needed just 192 KB. The tool grabbed whatever repository it ran in, not the files it needed. The fix arrived as a hidden flag, disable codebase upload: true, a day after a researcher's wire-level analysis. The "Improve the model" opt-out never stopped the uploads. Still no advisory, no scope, no word on whether already-uploaded code gets deleted. For anyone pointing AI coding agents at proprietary code, what crosses the wire matters more than what the settings page says.