xAI's Grok Build CLI silently uploads entire codebases, secrets included, researcher shows

An independent security researcher has published reproducible, wire-level evidence that xAI's Grok Build command-line coding tool uploads a developer's entire codebase to a Google Cloud Storage bucket in the background, separate from anything the AI model actually reads or was asked to act on. The finding has generated significant attention on Hacker News, with two related threads collecting more than 400 and 250 points respectively within hours of posting.

What the traffic capture showed

Using a proxy to intercept and analyze network traffic, the researcher documented that Grok Build sends a full git bundle of the working directory to a storage endpoint at POST /v1/storage, landing in a bucket named grok-code-session-traces. On a test repository of roughly 12 gigabytes, the tool transferred 5.10 gigabytes across 73 chunks, with all 83 storage requests returning a successful HTTP 200 response.

Critically, the researcher demonstrated that the upload is not scoped to files the AI agent actually touched during a session. A file the agent never opened or referenced was recovered intact from the captured upload bundle — proving the tool ships the entire workspace state, not just the files relevant to the task at hand. In the reproduction case, an unredacted .env file containing credentials was included in the uploaded bundle.

The opt-out doesn't cover this

Grok Build includes an “Improve the model” toggle that developers can disable, but the researcher's analysis found this setting governs whether uploaded data is used for model training — it does not stop the underlying upload of the codebase from happening in the first place. Neither the existence of the grok-code-session-traces bucket nor this distinction between “won't train on it” and “won't upload it” is documented anywhere in Grok Build's setup or onboarding materials, according to the research.

Why this matters for developers

AI coding agents routinely operate inside repositories containing API keys, database credentials, and proprietary source code, on the assumption that only files the agent explicitly reads or references are shared with the vendor's servers. This finding breaks that assumption for Grok Build specifically: a developer running the tool inside a private codebase has, according to the reproduction steps, had that entire codebase — including secrets never touched by the AI — transmitted to xAI's infrastructure regardless of training-data preferences.

Security researchers are recommending that any developer who has run Grok Build inside a repository containing credentials treat those credentials as potentially exposed and rotate them as a precaution. xAI has not yet issued a public statement addressing the specific findings as of this report.