- Published on
Xai-org/grok-build, now open source
- Authors
- Name
- DeepHorus
In a dramatic response to a severe privacy backlash, xAI has open-sourced the entire Grok Build codebase under an Apache 2.0 license, just one day after its Grok CLI tool was found to upload entire directories—including SSH keys and password databases—to Google Cloud servers. The move, announced on 15 July 2026, aims to rebuild user trust by offering complete transparency and the ability to run the tool fully locally. The code release comes after xAI disabled the controversial data upload feature and deleted all retained coding data from users.
The controversy erupted on 14 July when users discovered that running the Grok command in any directory would upload that directory's entire contents to xAI's Google Cloud buckets. One user reported that executing the tool in their home directory resulted in uploading "my SSH keys, my password manager database, my documents, photos, videos, everything." Social media erupted with criticism, prompting xAI to respond swiftly. Elon Musk stated, "As a precautionary measure, all user data that was uploaded to SpaceXAI before now will be completely and utterly deleted."
xAI's official thread detailed their corrective actions: data retention was disabled by default starting 12 July, all previously retained coding data has been deleted, and an open-source harness now allows users to run Grok Build locally with their own inference. The company claimed this made Grok Build "go beyond other major coding products to protect user privacy." The open-source repository, hosted under the xai-org organization, contains the entire Grok Build codebase with 844,530 lines of Rust, only about 3% of which is vendored.
A deep dive into the repository reveals several noteworthy technical components. The main system prompt resides at xai-grok-agent/templates/prompt.md, while subagent_prompt.md oddly instructs the agent not to reveal its system prompt to the user—a restriction absent from the main prompt. The codebase includes a full Mermaid diagram renderer using Unicode box-drawing, and tool implementations ported from OpenAI's Codex and OpenCode's projects, compliant with Apache and MIT licenses. Remnants of the Google Cloud upload code remain in xai-grok-shell/src/upload/gcs.rs but are disabled, returning a hard-coded session_state_upload_unavailable error.
The immediate impact is that users can now inspect, modify, and run Grok Build entirely offline, eliminating the privacy risks that sparked the backlash. Developers and privacy advocates have expressed cautious optimism, praising the open-source decision but noting that trust will take time to rebuild. The incident has also intensified scrutiny on coding agents that rely on cloud uploads, with competing tools like Codex and Claude Code facing renewed questions about their data handling practices.
Industry analysts view this as a pivotal moment for xAI, which must now prove its commitment to privacy. The open-source release could foster a community of contributors who improve the tool and audit its security. However, with only a single commit so far, the codebase lacks version history, limiting insights into its development. The 844,530 lines of Rust underscore the surprising complexity of terminal coding agents—OpenAI's Codex boasts 950,933 lines—highlighting the engineering investment behind such tools.
Looking ahead, xAI plans to continue developing Grok Build in the open, accepting community feedback and contributions. The company emphasized that data retention is now disabled by default for all users, and future updates will prioritize local-first operation. This incident may serve as a cautionary tale for AI tool makers, reinforcing the need for transparent data practices and giving users control over their information.
In a broader context, this event underscores the growing tension between convenience and privacy in AI-powered coding assistants. As coding agents become more sophisticated, the line between helpful automation and invasive surveillance blurs. xAI's open-source pivot not only aims to rectify a critical mistake but also sets a new standard for accountability in the AI industry—one where user privacy is not an afterthought but a foundational principle.
