SpaceXAI's Grok Build uploaded users' entire codebases to Google Cloud
Security researcher reveals Grok Build sent full repos, including deleted secrets, to cloud.
SpaceXAI's Grok Build CLI, an AI coding assistant, was found to be uploading users' entire code repositories to Google Cloud storage. Security researchers at Cereblab published findings showing the tool packaged and transmitted full codebases, including files that developers had explicitly told it to ignore (via .gitignore) and secrets that had been deleted from version history. This behavior went well beyond similar tools like Claude Code, which typically only sync necessary contexts. The uploads occurred without clear disclosure to users, raising significant privacy and security concerns.
SpaceXAI responded by disabling the codebase upload feature, returning a 'disable_codebase_upload: true' flag on their servers. Elon Musk posted on X that all previously uploaded data would be 'completely and utterly deleted,' while simultaneously asking users to opt into data retention for 'debugging issues.' Dr. Lukasz Olejnik, a security researcher at King's College London, confirmed that the data retention was 'excessive,' potentially exposing proprietary source code, credentials, security vulnerabilities, and infrastructure details. The incident highlights the tension between AI tool performance and user privacy in the rapidly evolving coding assistant market.
- Grok Build uploaded entire codebases to Google Cloud, including files in .gitignore and deleted secrets, unlike competitors.
- SpaceXAI disabled the upload feature and Musk promised deletion of all prior data, but asked users to allow retention for debugging.
- Security researchers called the data retention 'excessive,' risking exposure of proprietary code, credentials, and vulnerabilities.
Why It Matters
This incident underscores critical privacy risks in AI coding tools, especially regarding unapproved data exfiltration and retention.