Grok Build Caught Uploading Entire Codebases; Musk Promises Deletion

SpaceXAI's Grok Build, an AI coding tool pitched as a developer assistant, was found to be uploading users' entire code repositories to Google Cloud — including files explicitly told to ignore and secrets deleted from git history. The discovery, published Monday by security firm Cereblab, showed that the Grok Build CLI was packaging far more data than comparable tools like Claude Code, raising alarms about excessive data retention.

As of Monday, SpaceXAI's servers returned a disable_codebase_upload: true flag, and the upload functionality no longer fires, according to Cereblab's tests. Elon Musk responded on X, claiming all previously uploaded data will be "completely and utterly deleted." He also asked users to allow data retention for "debugging issues," asserting that "privacy settings are always respected."

The company initially pointed to a /privacy CLI command as a control, but Cereblab noted that command operates as a per-session retention toggle, not the switch that fixed the underlying upload behavior.

Independent security researcher Dr. Lukasz Olejnik told The Verge the data retention is "excessive," with potential exposure including "proprietary source code, information about security vulnerabilities, personal data, infrastructure details, [and] credentials."

For developers using Grok Build, the incident underscores the risk of trusting AI coding tools with unfettered access to repositories — especially when default behavior may exfiltrate more than expected. Users who have used the tool should rotate any credentials or secrets that may have been in their repos.