Grok Build Was Quietly Uploading Your Entire Codebase to the Cloud. xAI Has Now Switched It Off.
Researchers caught xAI's new coding tool sending far more data to its servers than users knew about, including files they had explicitly excluded and credentials they'd already deleted.
Key points
- Grok Build, xAI's AI coding assistant, was uploading entire code repositories to Google Cloud without clear user consent, researchers found in May 2025.
- Uploads included files users had told the tool to ignore, plus secrets already deleted from project history.
- As of Monday, xAI's servers return a flag that disables codebase uploads, and the transfers have stopped.
- Elon Musk posted that all previously uploaded data will be "completely and utterly deleted."
- An independent security researcher called the data retention "excessive," noting it could expose proprietary code and passwords.
Grok Build is xAI's command-line coding assistant, a developer tool you install locally and use to write and edit software with AI help. Researchers at Cereblab published findings this week showing the tool was packaging entire project folders and sending them to Google Cloud storage before each AI interaction.
What alarmed security experts was the detail: the uploads included files users had specifically told the tool not to open, and credentials that developers had already removed from their project history. Similar tools, including Anthropic's Claude Code, don't collect nearly this much data.
As first reported by The Verge, independent security researcher Dr. Lukasz Olejnik of King's College London confirmed the data haul was "excessive." What's at risk could include proprietary source code, details about security weaknesses, personal data, infrastructure details, and login credentials. For most developers, those are exactly the files you'd never want a third party holding.
Should developers be worried about data already uploaded?
Yes, but xAI says it's acting quickly. Elon Musk posted on X that all data Grok Build previously collected will be "completely and utterly deleted." The uploads have already stopped: Cereblab confirmed that xAI's servers now send a signal telling the tool not to upload codebases, and their tests show the transfer no longer fires.
XAI's initial response pointed users toward a command called /privacy inside the tool, suggesting it would stop data retention. Cereblab pushed back. The /privacy command only toggles retention for a single session. It wasn't the fix that stopped the bulk uploads.
Musk also posted that "privacy settings are always respected," while separately asking users to let xAI keep their data to help with debugging. That combination struck some observers as contradictory.
Our earlier story on AI coding costs, published 13 July 2026, noted that these tools are already expensive enough to draw executive scrutiny. Add an unexpected data exposure to that ledger and the business case gets harder to defend.
If you've used Grok Build on any project containing passwords or API keys (codes that grant access to external services), treat those credentials as potentially compromised. Rotate any secrets that were in those repositories. It takes minutes and removes the risk.
