Grok Build Reported for Uploading Entire Repositories
TheZachMueller · x · 2026-07-14
Reports indicate that xAI's Grok Build CLI uploads entire Git repositories—including private codebases and unmasked secrets—to a Google Cloud bucket.
Key findings:
- On a 12GB test repository, the tool uploaded about 5.1GB of data to the grok-code-session-traces bucket, while the actual coding task only required 192KB.
- It scrapes the entire repository in the working directory rather than just the files needed for the task.
- A hidden toggle disablecodebaseupload: true appeared a day later, but the previous "Improve the model" opt-out did not prevent the upload.
- xAI has yet to clarify the scope, retention period, and deletion methods for the data.
More from coding & agent
- Devin adds e2b sandboxes for remote agent execution — badphilosopher · 2026-07-22
- Hermes Agent Refactoring Proposal: Decoupling via Event Bus and Monorepo Slicing — Promptmethus · 2026-07-22
- ty now reads Pydantic config keywords and field metadata — charliermarsh · 2026-07-22
- Pensar Launches AI Security Agent to Autonomously Discover and Patch 0-Days — andriy_mulyar · 2026-07-22
- ty adds first-class Pydantic support, including strict and lax field handling — charliermarsh · 2026-07-22
- Google launches Gemini 3.5 Flash Cyber for CodeMender, with limited access for governments — GoogleAI · 2026-07-22