Grok Build's Secret Uploads: SpaceXAI's Open-Source Pivot and the Quest for Trust

The world of AI-powered developer tools recently witnessed a significant shake-up, as SpaceXAI's Grok Build, a promising coding agent, found itself at the center of a privacy storm. The incident, which saw the tool secretly uploading users' complete codebases, has led to an urgent open-source release and a broader conversation about data privacy, transparency, and trust in AI development.

The Unveiling of a Covert Operation

The controversy erupted around July 15, 2026, when security researchers, notably Cereblab and a user identified as @a_green_being, discovered that Grok Build version 0.2.93 was covertly transmitting entire Git repositories to a Google Cloud Storage bucket controlled by xAI. The uploads, packaged as "Git bundles" – complete with tracked files and full commit histories – were happening regardless of whether users had disabled the "Improve the model" toggle.

Even more alarmingly, @a_green_being reported that running Grok Build in a home directory led to the upload of highly sensitive personal files, including Secure Shell (SSH) keys, password-manager databases, documents, photos, and videos. This starkly contradicted xAI's initial marketing claims that "nothing from your codebase" was transmitted to its servers. Tests showed a 12 GB proxy run could send 5.10 GiB of data through a separate storage channel, independent of model-turn traffic. The scope of potential exposure, encompassing credentials like API keys and database passwords, sent a chill through the developer community.

SpaceXAI's Response: A Swift, Yet Incomplete, Turnaround

In the face of mounting public pressure, SpaceXAI, through its CEO Elon Musk and official channels, initiated a rapid response. On July 12, the company disabled the secret repository uploads by changing a server-side flag, disable_codebase_upload: true. Following this, on July 14, Elon Musk publicly committed to deleting all previously retained coding data, though no audit mechanism or timeline for verification has been provided.

The most significant step came on July 15, with SpaceXAI open-sourcing Grok Build's coding-agent harness and terminal-interface code under the Apache 2.0 license. This move was presented as a means to foster greater trust and allow developers to inspect the agent loop, compile the harness locally, and select their own model endpoints. SpaceXAI also admitted that, while enterprise customers had Zero Data Retention (ZDR) by default, data retention was enabled by default for non-ZDR users during the early beta phase – a practice it has now corrected.

Lingering Questions and the Nature of "Open-Source"

While the open-source release of Grok Build's 844,530 lines of Rust code (as noted by Simon Willison) is a commendable step towards transparency, several critical concerns remain. The public GitHub repository began with a single commit, preventing scrutiny of how the upload mechanism was introduced or evolved during private development. More importantly, security researchers confirmed that the code capable of exfiltrating entire codebases remains present in the published binary. It is merely held off by a server-side configuration flag, meaning SpaceXAI retains the technical ability to re-enable full-repository uploads for any or all users without pushing a new software update.

Furthermore, SpaceXAI's open-source repository does not accept outside contributions, directing vulnerability reports to its HackerOne program. This centralization means SpaceXAI still controls all merged fixes and future changes. The company has also not provided details on the number of affected users, the total volume of data collected, or a clear method for developers to verify the deletion of their specific data. It's crucial for users to understand that the /privacy command, which governs data retention for model training, is distinct from the server-side flag that stopped data transmission.

Implications for Trust and the Future of AI Tools

The Grok Build incident serves as a stark reminder of the critical importance of privacy and transparency in the rapidly evolving AI landscape. For developers, the message is clear: exercise extreme caution with AI tools that handle sensitive code. The episode underscores the value of genuinely auditable, local-first solutions (like OpenCode, Aider, or Cline) and the need for rigorous third-party security audits.

SpaceXAI's swift, albeit imperfect, response highlights the power of community scrutiny in holding tech giants accountable. While the open-sourcing of Grok Build offers a path to greater transparency and local control, the lingering concerns about the dormant upload code and the lack of comprehensive deletion audits mean that regaining full user trust will be an ongoing endeavor. The incident is a pivotal moment, shaping expectations for privacy and accountability in the AI-powered development tools of tomorrow.