xAI's Grok Build coding assistant was quietly uploading users' entire code repositories to Google Cloud, including files developers had explicitly told the tool to ignore and secrets that had been deleted from git history. Security firm Cereblab published the findings on Monday, and by the same day xAI's servers began returning a new flag, 'disable_codebase_upload: true', that shuts the behavior off. Elon Musk said on X that any data already collected will be 'completely and utterly deleted.'
The scope of what Grok Build was hoovering up is the part that stings. Cereblab documented the CLI packaging whole repositories and shipping them to xAI-controlled cloud storage, well beyond the file-by-file context that comparable agentic coding tools request. The researchers specifically flagged that the uploads included files the tool was told not to open and secrets that had been removed from history — the kind of material developers assume stays local.
Claude Code, Anthropic's CLI-based coding agent and the closest competitor to Grok Build, retains substantially less data by default, per Cereblab. That comparison is doing a lot of work here: developers evaluating AI coding tools have generally assumed the frontier CLIs behave similarly on data handling. Grok Build was an outlier, and there was no clear disclosure that full-repo uploads were happening.
Key facts
- 01Cereblab published findings on Monday showing Grok Build's CLI uploaded entire user repositories to Google Cloud, including gitignored files and secrets deleted from history.
- 02As of Monday, xAI's servers began returning a 'disable_codebase_upload: true' flag, and the codebase upload no longer fires in Cereblab's tests.
- 03Musk said on X that previously uploaded data will be 'completely and utterly deleted' and asked users to opt in to retention for debugging.
- 04Comparable tools such as Claude Code retain significantly less data than what Grok Build was capturing, according to the Cereblab writeup.
- 05Security researcher Dr. Lukasz Olejnik of King's College London said the exposed data could include proprietary source code, credentials, and infrastructure details.
Dr. Lukasz Olejnik, an independent security researcher at King's College London, confirmed the volume of data retention was excessive. He said the exposed material could include proprietary source code, information about security vulnerabilities, personal data, infrastructure details, and credentials — essentially the full attack surface of any organization whose engineers had tried the tool.
xAI's initial public response pointed users to the CLI's /privacy command, saying that if zero data retention is disabled, /privacy is available in the CLI to disable data retention, which also deletes previously synced data. Cereblab pushed back: /privacy is a per-session retention toggle, not the switch that fixed this, so it shouldn't be pointed to as the control. In other words, the command xAI cited did not actually govern the repository-upload behavior researchers had exposed.
Musk followed with two X posts of his own. In one, he said previously uploaded data would be deleted. In another, he said privacy settings are always respected but asked users to voluntarily allow xAI to retain their data because it is helpful for debugging issues.
“completely and utterly deleted”— Elon Musk, xAI founder
There is no public accounting yet of how many developers ran Grok Build against private repositories before the server-side flag flipped, or how xAI intends to verify the deletion. The company has not published a post-mortem, a data-retention policy update, or an independent audit of what was captured and where it was stored. For enterprise users who piloted the tool, the practical question is whether credentials and API keys that touched a Grok Build session need to be rotated regardless of xAI's assurances.
The incident lands in a market where coding agents are the most commercially serious application of large language models. GitHub Copilot, Cursor, Claude Code, and Grok Build all compete for the same developer seat, and trust in how each tool handles source code is now a purchase criterion, not a footnote. A CLI that silently ships gitignored files is a category-level trust problem, not a Grok-specific bug.
The counterweight worth stating: Cereblab and xAI both agree the upload behavior has been disabled server-side, and Musk has publicly committed to deletion. If xAI follows through with a transparent write-up of what data was collected, how long it was stored, and what deletion looked like in practice, the recovery path is straightforward. If it doesn't, security teams at any company whose engineers touched the tool will have to assume the worst.
The broader read is that xAI's product velocity is running ahead of its data-governance discipline in a segment where the opposite ordering is table stakes. Coding tools live or die on whether CISOs approve them, and CISOs do not approve tools that upload repositories by default. Grok Build's usable feature set will not matter to enterprise procurement until xAI publishes the kind of retention policy, audit trail, and default-off posture that its competitors already ship with. Fixing the flag was the easy part; earning back the review committee is the expensive one.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
