xAI's Grok Build Was Uploading Whole Repos, Secrets and All, to a Cloud Bucket

xAI's Grok Build Was Uploading Whole Repos, Secrets and All, to a Cloud Bucket

6 min readJuly 14, 2026

Quick verdict

Security researchers allege that xAI's Grok Build CLI was uploading entire repositories, including private source and secrets, to a Google Cloud bucket, well past what the coding task needed. xAI responded that teams on zero data retention are not affected, that API-key usage respects ZDR, and that a /privacy command disables retention and deletes previously synced data. Forget the specific bug for a second. Your AI coding agent is a network client, and most people have no idea what it puts on the wire. If you run any of these tools against private code, this is the week to check.

What the researchers found

The thread started with IntCyberDigest, who reported that Grok Build's CLI was pushing whole repositories to an xAI-controlled Google Cloud bucket rather than sending only the files relevant to a given task. hrkrshnn followed with more detail, and the criticism landed on three points: the scope of what was uploaded, a mitigation that appeared to happen silently on the server side, and unclear guarantees about how long the data was retained or whether it was deleted.

The scope is the part that makes engineers wince. A coding agent usually needs the file you are editing plus some surrounding context. Shipping the full tree means any API keys, .env files, private tokens, or customer data sitting in the working directory can leave your machine without an obvious prompt. For a solo side project that is annoying. For anyone touching production credentials or client code, it is a compliance problem.

xAI's response, and what it does not settle

xAI answered through its SpaceXAI account. The reply said that for teams using zero data retention, trace and code data is not kept, that API-key usage respects ZDR, and that the /privacy command can turn off retention and delete data that was already synced. That is a real answer to the "is it retained" question, and the existence of a delete path is better than nothing.

What it does not resolve is the default. ZDR is usually an enterprise setting, not the state a first-time user is in when they run a CLI for the first time. If the default behavior uploads more than expected and the fix is a command you have to know exists, then the people most exposed are the ones least likely to have flipped the switch. The gap between an opt-out buried behind a slash command and what actually travels over the wire is the whole story here, and it is not unique to xAI.

Why it matters beyond one tool

The incident dropped into an ongoing argument about trust boundaries in agent tooling. mchiang0610 and jmorgan both argued that open models are not only about cost, they are about keeping control of the human-AI loop and keeping institutional knowledge in-house. Run the weights yourself and the question of what leaves your network answers itself. On the closed side, Arav Srinivas said ZDR availability was one reason Perplexity integrated Grok 4.5 into its Computer harness quickly, which tells you enterprises now treat data-retention terms as a gating requirement, not a nice-to-have.

So "does this model score well" is no longer the only question when you pick a coding agent. "What does the client actually transmit, and can I prove it" now sits right next to it. That is a healthy shift, even if it took a bad week for one vendor to force it.

How to check what your own coding agent sends

You do not have to trust anyone's tweet. A few minutes with standard tools will tell you what a CLI puts on the wire.

  • Watch the traffic. Point the agent at a throwaway repo and run a proxy such as mitmproxy, or filter on the process in Little Snitch or a firewall, and look at request bodies. If a full tree goes out when you only edited one file, you have your answer.
  • Check the data-retention terms before you paste anything sensitive. Look for zero data retention, whether it is on by default or opt-in, and whether there is a documented deletion path. For Grok Build specifically, run /privacy and delete synced data.
  • Keep secrets out of the working directory. Load credentials from outside the repo, add .env and key files to ignore lists the agent honors, and rotate any token that may already have been uploaded.
  • If the code cannot leave your network at all, prefer a self-hosted open-weight setup. Our writeup on routing to open models covers the control tradeoff, and the open-source model roundup lists what is actually runnable.

Video: the hidden security risks of AI coding agents

A plain-English look at what coding agents can leak and how to reason about the trust boundary before you point one at private code.

FAQ

Was my code actually leaked if I used Grok Build?

Researchers allege the CLI uploaded full repositories to an xAI cloud bucket, and xAI says a server-side mitigation was applied and that /privacy deletes previously synced data. If you ran it against anything sensitive, assume the working directory may have been uploaded, run /privacy, delete synced data, and rotate any exposed secrets rather than waiting for a definitive account.

Does zero data retention fix this?

xAI says ZDR teams are not affected and that API-key usage respects it. The catch is that ZDR is usually an enterprise setting rather than the default for an individual running the CLI for the first time, so check whether it is actually on for your account before relying on it.

How do I know what any coding agent uploads?

Run it against a disposable repo behind a network proxy such as mitmproxy and read the request bodies, or filter the process in a firewall. If it sends far more than the files you touched, that is a signal to tighten what lives in the working directory. Our coding-agent comparison and Claude Code alternatives can help you weigh options.

Sources

Further reading

Try all the models mentioned in this article

Admix gives you GPT-5, Claude, Gemini, and 350+ AI models in one app. Compare responses side by side. Free to start.

Start free on Admix

Related articles