- Published on
What xAI's Grok Build CLI Actually Sends to xAI
- Authors
- Name
- DeepHorus
A security researcher has uncovered that xAI's Grok Build CLI tool transmits entire repository contents, including secrets and files the agent is told not to read, to xAI's servers regardless of privacy settings. The findings, detailed in a teardown, show the CLI uploads all tracked files and git history to a Google Cloud Storage bucket named 'grok-code-session-traces', even when users disable the 'Improve the model' toggle. This raises significant privacy concerns for developers.
The investigation focused on Grok Build version 0.2.93, installed via xAI's official script on macOS. Using a throwaway repository with fake 'canary' secrets, the researcher captured traffic via mitmproxy. They found the CLI transmits file contents verbatim to a model endpoint and uploads the entire repository as a git bundle to a storage endpoint, without warning users in the CLI's quickstart materials.
Key evidence includes a test where, even after prompting 'reply OK, do not read any files', the CLI uploaded a git bundle containing a file named 'never_read_canary.txt' with its unique marker. In a 12 GB repo test, storage endpoint received 5.10 GiB (HTTP 200), while model turn used only 192 KB—a 27,800× ratio confirming repository-wide upload. The storage destination is hardcoded as 'gs://grok-code-session-traces'.
The implications are serious: private code and secrets are sent to xAI by default, even with privacy controls disabled. The researcher confirmed disabling 'Improve the model' did not stop uploads; trace upload remained enabled. While the report does not prove xAI trains on the data, it proves transmission, acceptance, and storage of all repository contents.
Developer reactions have been swift, with concern over lack of transparency. The upload machinery is a first-party Rust crate with source paths like 'xai-data-collector/src/gcs.rs' visible in the binary. xAI has not yet issued a public statement. Users should assume their entire codebase is uploaded upon use.
Until xAI addresses these findings with clear opt-in mechanisms or documentation, developers handling sensitive code should exercise caution. The incident underscores broader concerns about data handling in AI coding assistants.
