Grok Build CLI Leaks Private Repositories
rickasaurus · x · 2026-07-14
xAI's Grok Build CLI was found to upload entire Git repositories to a Google Cloud bucket, including private codebases and unmasked API keys.
After researchers disclosed this through line-level analysis, the upload behavior appeared to be disabled via a hidden server-side switch. However, xAI has yet to clarify the scope of impact, data retention policies, or a deletion timeline. Even if the data is eventually deleted, credentials that have already left the local machine need to be rotated immediately.
More from coding & agent
- Coding agents are heading toward an AI-writes, AI-reviews, human-approves workflow — aftahi_ai · 2026-07-22
- oMLX 0.5.2 adds Mac menu-bar stats, low-bit decode kernels, and faster downloads — awnihannun · 2026-07-22
- GitHub review bot hits its PR limit and forces a 39-minute cooldown — DanielLockyer · 2026-07-22
- Max reasoning effort appears to be mobile-only in Codex Remote, not desktop — GabGarrett · 2026-07-22
- A Reddit demo argues online stores should expose carts and pricing through MCP — gelembjuk · 2026-07-22
- Open-source AI SDK provider routes Vercel apps through a local Codex subscription — lgrammel · 2026-07-22