A security researcher placed a “canary” file in a test repository — a file the AI agent was explicitly told not to read — then watched Grok Build upload it anyway. The wire capture showed it all: a background channel, completely separate from model inference, shipping a full Git bundle to a SpaceXAI-controlled cloud bucket. Not a sample. Not context. The whole thing: 5.1GB transferred from an 11.2GB repository for a task that needed about 192KB. That is a 26,000x overshoot. SpaceXAI open-sourced the entire 844,530-line Rust codebase 72 hours later. The question is not whether that was the right call — it clearly was. The question is what the code actually shows now that you can read it.
What Was Actually Happening #
Grok Build 0.2.93 ran two separate network channels. One handled model inference — the files needed to answer your question. The other was a background upload to a storage endpoint, silently bundling your entire Git repository and shipping it independently. The “Improve the model” toggle in the privacy settings controlled what SpaceXAI did with data after it arrived. It had no effect on whether the upload happened.
Researcher Cereblab captured the storage-bound traffic, cloned the Git bundle from the intercepted request, and recovered the canary file — the one the agent had been told to ignore. The bundle included committed secrets, deleted branches, old commits, and .env files with live credentials. Everything your repository has ever contained.
The Open Source Catch #
The xai-org/grok-build repository is now live under Apache 2.0. The 844,530 lines of Rust cover the full agent loop, tool implementations (read, edit, search, execute), the terminal UI, and the extension system. You can compile it, modify it, and inspect every network path it touches.
What you cannot read is grok-build-0.1, the model that actually powers the agent. That stays closed, running through SpaceXAI’s paid API. You can compile the harness from source and point it at a different inference endpoint — the code supports OpenAI and Anthropic-compatible APIs — but the default configuration still calls home. Open harness, closed model, company-controlled inference. That is the actual state of “open source” here.
The Hacker News thread for the release cleared 90 points and 100+ comments. The consensus: pure damage control. It is hard to argue otherwise. When open-sourcing follows a data exfiltration scandal by 72 hours, the motive is not idealism.
What the Code Does Reveal #
That said, the source release is genuinely useful for understanding what you are running. The architecture now shows that model inference, telemetry, trace uploads, remote sessions, plugins, and MCP server connections are all distinct network paths. Each one requires separate configuration. The post-breach update added /privacy opt-out
as an in-session command and documented telemetry = false
and trace_upload = false
config options.
Before this, the privacy UI suggested a single toggle handled data sharing. The source code shows six different outbound channels. That gap between the settings screen and the network layer is exactly what the original breach exploited.
This Is Not an Isolated Incident #
Grok Build is the most visible example of a pattern. In January 2026, the MaliciousCorgi campaign discovered two VS Code AI coding extensions with a combined 1.5 million installs that captured every opened file and transmitted it to an external server. In February, SANDWORM_MODE used 19 typosquatted npm packages to deploy rogue MCP servers that extracted SSH keys, AWS credentials, and npm tokens from developer machines.
The Cloud Security Alliance’s 2026 research note on AI coding assistant attack surfaces identifies four exposure categories: data exfiltration, credential exposure, code IP leakage, and compliance failures. Grok Build hit all four.
What to Do Now #
The settings menu is not the audit. If you are running any AI coding CLI — Grok Build, Claude Code, Cursor, anything — the only reliable verification is wire-level traffic analysis. Run a proxy like mitmproxy while the tool is active and compare bytes sent to bytes your task actually required. Look specifically for upload traffic that does not route through the inference endpoint. Test with canary files placed outside the agent’s stated context window.
For Grok Build specifically: set telemetry = false
and trace_upload = false
in your config, run /privacy opt-out
in-session, and review the full breach report from The Next Web. The repository is open. The trust is not automatic.