xAI's Grok Build CLI was silently uploading entire codebases—including secrets—to the cloud

What happened

On Monday, July 14, 2026, security researcher Cereblab published findings from a wire-level analysis of xAI's Grok Build CLI (version 0.2.93), the AI coding assistant from Elon Musk's xAI venture. Using a proxy to intercept traffic from controlled test repositories seeded with fake canary credentials, Cereblab discovered that the tool was doing far more than reading files to answer coding questions—it was packaging and uploading entire Git repositories to cloud storage.

The findings, reported by The Register and surfaced by The Verge, detail two distinct data-transmission paths. First, when Grok Build reads a local file, its contents are sent verbatim through the model-request channel (POST /v1/responses). During testing, unredacted fake API keys and database passwords stored in a .env-style file appeared in the captured request data—and the same sensitive information also showed up in a session-state archive sent through POST /v1/storage.

Second, and more alarmingly, a separate background upload mechanism packaged and transferred an entire Git repository rather than just the files relevant to a coding task. The captured Git bundle included files the agent had been explicitly instructed not to read, as well as the repository's full commit history. In one test, Cereblab used the prompt: "Reply with exactly: OK. Do not read or open any files." Despite that instruction, the upload still proceeded.

According to TechTimes, wire captures documented approximately 5 GB of data uploaded per session, and a privacy toggle in the tool's settings did nothing to prevent the uploads. xAI turned off the behavior after being reported, but no formal advisory was issued to users.

Why it matters

AI coding assistants are becoming standard tooling for developers, and they require deep access to local codebases to function. But there is a fundamental difference between reading files to generate a response and silently exfiltrating an entire repository—including secrets, environment variables, and Git history—to a vendor's cloud.

The Grok Build findings highlight several systemic risks in the AI coding-tool category:

• Secrets exposure. Unredacted .env contents, including API keys and database passwords, were transmitted in plaintext. For any developer who used Grok Build against a real production repository, live credentials may have been sent to xAI's infrastructure.

• Instruction non-compliance. The tool uploaded files even when explicitly told not to read or open them. This undermines the assumption that prompt-level instructions can serve as a reliable access-control mechanism.

• Ineffective privacy controls. A privacy toggle that does nothing is arguably worse than no toggle at all, because it gives users a false sense of control.

• No user notification. xAI disabled the behavior but, according to reporting, issued no advisory. Developers who used the tool before the fix may be unaware their code and credentials were uploaded.

This is not unique to xAI. Any AI coding tool that processes local repositories faces the same tension between utility and data exposure. But the Grok Build case is a particularly stark example of a tool overstepping its stated function and doing so silently.

What to watch

• Whether xAI issues a formal advisory or notification to users who may have been affected before the behavior was disabled.
• Whether other AI coding tools (Cursor, GitHub Copilot, Cody, etc.) undergo similar wire-level audits in the wake of these findings.
• Whether this incident prompts regulatory scrutiny under data-protection frameworks, particularly if any affected repositories contained personal or regulated data.
• Whether xAI publishes a technical postmortem explaining how the background upload mechanism worked and why the privacy toggle was non-functional.