xAI's Grok Build CLI Allegedly Uploads Entire Repos and Secrets
Starting July 11, multiple developers, including Reddit user @TastyLeadership2757, used mitmproxy to allege that xAI's Grok Build CLI silently uploads entire codebases to xAI's cloud during operation. This includes full Git history and local sensitive files, sparking widespread concern over the privacy and security of AI coding tools.
Key Details
According to packet captures and reverse engineering, the tool does not merely upload files the agent actually reads. Instead, it bundles the entire repository into a git bundle (including full Git history) and uploads it to xAI's Google Cloud Storage. It also transmits the contents of files read by the agent, including secrets like `.env` files, and potentially even local configurations and API keys outside the repository. This upload behavior is independent of whether the files are explicitly read, meaning secrets could be uploaded even if they were never invoked by the tool.
Community Response and Investigation
The incident gained further traction after being shared and investigated by users like @scaling01 and @数字生命卡兹克. @数字生命卡兹克 provided a relatively complete reproduction and troubleshooting path, including steps to reverse engineer the official npm package, enabling the community to verify the claims. Users such as @code_star and @Tiancaixinxin shared the news as a warning, reminding developers of the risks of data exfiltration, logging, or leakage when handing over environment variables and secret files to AI tools.
2026-07-11 ~ 2026-07-13 · 5 related posts
- Episode 1: xAI's Grok Build CLI Allegedly Uploads Entire Repos and Secrets(2026-07-11, 5 posts)
- Episode 2: Grok Build/CLI accused of silently uploading entire codebases; xAI promises to delete data(2026-07-13, 47 posts)
- Episode 3: Grok Faces Trust Crisis Over Major Privacy Concerns(2026-07-15, 2 posts)
- [source] Grok Build CLI Exposed for Uploading Entire Repos and Secrets — TastyLeadership2757 · 2026-07-11
- Grok Accused of Leaking .env Secrets — code_star · 2026-07-12
- Grok Build Reportedly Uploads Entire Repos and Secret Keys — scaling01 · 2026-07-12
- [source] GrokCLI Accused of Silently Uploading Code Repositories — 数字生命卡兹克 · 2026-07-13
1 near-duplicate retellings: Tiancaixinxin