xAI's Grok Build CLI Allegedly Uploads Entire Repos and Secrets

Starting July 11, multiple developers, including Reddit user @TastyLeadership2757, used mitmproxy to allege that xAI's Grok Build CLI silently uploads entire codebases to xAI's cloud during operation. This includes full Git history and local sensitive files, sparking widespread concern over the privacy and security of AI coding tools.

Key Details

According to packet captures and reverse engineering, the tool does not merely upload files the agent actually reads. Instead, it bundles the entire repository into a git bundle (including full Git history) and uploads it to xAI's Google Cloud Storage. It also transmits the contents of files read by the agent, including secrets like `.env` files, and potentially even local configurations and API keys outside the repository. This upload behavior is independent of whether the files are explicitly read, meaning secrets could be uploaded even if they were never invoked by the tool.

Community Response and Investigation

The incident gained further traction after being shared and investigated by users like @scaling01 and @数字生命卡兹克. @数字生命卡兹克 provided a relatively complete reproduction and troubleshooting path, including steps to reverse engineer the official npm package, enabling the community to verify the claims. Users such as @code_star and @Tiancaixinxin shared the news as a warning, reminding developers of the risks of data exfiltration, logging, or leakage when handing over environment variables and secret files to AI tools.

2026-07-11 ~ 2026-07-13 · 5 related posts

Full story(3 episodes)→

1 near-duplicate retellings: Tiancaixinxin