Grok Build/CLI accused of silently uploading entire codebases; xAI promises to delete data

In mid-July, developers accused xAI's Grok Build/CLI of uploading entire codebases to the cloud by default during local use — far exceeding what tasks required, and potentially sweeping up Git history, secrets, and home-directory files. The dispute escalated from "is the data used for training?" to "was content sent off-box without adequate disclosure?", raising privacy and supply-chain concerns. xAI and Elon Musk responded by emphasizing Zero Data Retention (ZDR) and retroactive deletion, and pledged to wipe all previously uploaded data.

Controversy and test findings

op7418 first flagged (Jul 13) that the build CLI would package and ship the entire repository — including keys — to a remote endpoint. Line-level and binary analysis, relayed by jedisct1, banteg, and rickasaurus, gave concrete figures: in a 12GB test repo the tool uploaded 5.1GB while the actual coding task needed only a small fraction, with targets pointing to a Google Cloud bucket holding private repos and unredacted secrets; even with no tool calls invoked, the full codebase was still uploaded. ctjlewis's tests were the most damning: upload is on by default (requiring an explicit `disable_codebase_upload = true` to disable), and opting out did not stop it — he likened it to "stealing the `.git` directory." He added that launching Grok Build from the home directory could upload the entire home directory, including ssh keys, claude config, documents, and media. Scobleizer and Gergely Orosz framed the problem as actively uploading the whole repo, `.git` history, and files like `.env.local` and `.dev.vars`.

xAI's response

On Jul 13, SpaceXAI said enterprise teams with ZDR enabled leave no code traces in Grok Build and that API key usage follows ZDR; non-ZDR users can run `/privacy` in the CLI to opt out, with the setting retroactively deleting previously synced data. On Jul 14, Elon Musk added that the CLI in ZDR mode has never retained data since release — but that remote session lists, cloud agents, and handoff/share features may still store data. He then announced that, as a precaution, all previously uploaded user data would be permanently deleted. tetsuoai defended Grok, noting that both Grok Build and the Grok website offer opt-out at any time, comparable to other major AI companies.

Unanswered questions

Critics argue the core question is not whether data can be deleted afterward, but whether the default upload involved clear consent and why its scope ballooned to whole repos and unrelated files. Retweets from JFPuget and others stressed that xAI never explained why such uploads occurred in the first place; some accounts noted the behavior appeared to be switched off via a hidden server-side toggle after exposure.

2026-07-13 ~ 2026-07-15 · 47 related posts

Full story(3 episodes)→

• Episode 1: xAI Grok Build CLI 被曝静默上传整仓库及密钥(2026-07-11, 5 posts)
• Episode 2: Grok Build 被曝默认上传整个代码库引争议(2026-07-13, 47 posts)
• Episode 3: Grok 被曝重大隐私问题引发信任危机(2026-07-15, 2 posts)

• [source] Grok Build CLI Flagged for Key Leakage — op7418 · 2026-07-13
• Grok Build CLI Suspected of Uploading Private Repos — nickcraske · 2026-07-13
• Grok Data Sharing and Opt-Out Controversy — tetsuoai · 2026-07-13
• Grok Build CLI Accused of Uploading Entire Repos — WesEklund · 2026-07-13
• Grok Build Accused of Leaking Repo Data by Default — WesEklund · 2026-07-13
• Grok Build Accused of Secretly Scraping Local Repos — adrianscottcom · 2026-07-13
• Grok Accused of Uploading Entire User Directories to the Cloud — dbasch · 2026-07-13
• [source] xAI Highlights Grok Build Privacy and Zero Data Retention — SpaceXAI · 2026-07-13
• Grok Build Logs Suspected of Leaking Repo Info — kieranklaassen · 2026-07-14
• Grok Build Reportedly Uploads Entire Repositories — jedisct1 · 2026-07-14
• Grok Build Adds Privacy Opt-Out Command — ivan_bezdomny · 2026-07-14
• Questioning Grok Build's Privacy and Telemetry — WesEklund · 2026-07-14
• Grok Build Accused of Silently Uploading Code — banteg · 2026-07-14
• Grok CLI Faces Privacy Backlash Over Default Codebase Uploads — WesEklund · 2026-07-14
• CLI Data Retention Rules Clarified — tetsuoai · 2026-07-14
• xAI Tool Accused of Uploading Entire Code Repos — basedjensen · 2026-07-14
• xAI to Delete Historical User Data — elonmusk · 2026-07-14
• Elon Musk Clarifies Grok CLI ZDR Privacy — elonmusk · 2026-07-14
• Criticism Erupts Over Grok CLI Privacy Design — basedjensen · 2026-07-14
• Grok Build's Privacy Path Sparks Controversy — WesEklund · 2026-07-14
• Grok Build Updates Data Retention Settings — aman_madaan · 2026-07-14
• Grok CLI Accused of Secretly Uploading Repositories — WesEklund · 2026-07-14
• grok CLI Accused of Leaking Data — Far-Sock-3170 · 2026-07-14
• How to Turn Off Grok Build Data Sharing — weswinder · 2026-07-14
• Grok Build Supports Zero Data Retention — XFreeze · 2026-07-14
• Grok Uploads Plaintext Secrets When Reading Files — WesEklund · 2026-07-14
• Leak Risks of File Uploads in xAI — WesEklund · 2026-07-14
• Grok's Privacy Toggle Accused of Being Ineffective — aniketmaurya · 2026-07-14
• Grok Build Wipes History When Retention Is Disabled — XFreeze · 2026-07-14
• GrokBuild Exposed for Leaking Repository Data — 新智元 · 2026-07-14
• Grok CLI Accused of Leaking Codebases — basedjensen · 2026-07-14
• Grok Uploads Entire Codebase by Default — ctjlewis · 2026-07-15
• AI Coding Tool Accused of Uploading Code — weskambale · 2026-07-15
• [source] Grok Accused of Uploading Repositories and Secrets — ctjlewis · 2026-07-15
• Grok Build Called Out for Uploading Home Directory — ctjlewis · 2026-07-15
• Specifics on Grok Build's Upload Scope — ctjlewis · 2026-07-15
• Grok Build Accused of Ignoring Permissions to Upload Repos — ctjlewis · 2026-07-15
• xAI Adjusts Grok Build Privacy Handling — JFPuget · 2026-07-15
• Grok Build Allegedly Uploads Codebases — nickcraske · 2026-07-15
• Grok's Entire Repo Upload Sparks Privacy Controversy — Scobleizer · 2026-07-15
• Grok Plunges Into Privacy Trust Crisis — julielee_101 · 2026-07-15
• Grok Build Exposes Code Upload Risks — Substantial_Step_351 · 2026-07-15

5 near-duplicate retellings: charliermarsh · TheZachMueller · julianharris · rickasaurus · OwariDa