SpaceXAI's Grok Build CLI tool was secretly uploading users' entire code repositories to Google Cloud, including files it was told not to open and secrets deleted from history.

What Exactly Happened

Researchers from Cereblab discovered that SpaceXAI's Grok Build CLI was automatically uploading users' entire code repositories to Google Cloud. This wasn't limited to current files — the upload included the full Git history, keys that were added and then deleted, files the tool was told not to open, and other secrets.

According to The Register, when a user interacts with Grok Build, the tool can decide to package and upload the entire repository. In Cereblab's tests, the uploaded data included files ignored by .gitignore and files Grok Build was explicitly told not to process.

Comparison with Other Tools

The key concern is the amount of data being uploaded. Similar tools like Claude Code may upload selected code for reasoning or context, but Grok Build was taking the entire repository — making it significantly more aggressive in data retention.

"This amount of data retention is excessive," said Dr. Lukasz Olejnik, an independent security researcher at King's College London. "The data potentially at risk includes proprietary source code, information about security vulnerabilities, personal data, infrastructure details, and credentials."

SpaceXAI's Response

After the findings were made public, SpaceXAI's servers began returning a "disable_codebase_upload: true" flag, effectively disabling the automatic upload. Elon Musk responded on X, claiming that all data previously uploaded will be "completely and utterly deleted."

However, the company's initial response was confusing. SpaceXAI pointed to the "/privacy" command, suggesting users could opt out via this command. But Cereblab noted that "/privacy is a per-session retention toggle, not the switch that fixed this, so it shouldn't be pointed to as the control."

What This Means for Developers

This incident raises serious questions about data privacy in AI-powered coding tools. When you use an AI coding assistant, what data does it send to the cloud? How is it stored? Can it be deleted?

For Georgian developers, this is a crucial lesson. As more coding tools incorporate AI features, understanding their data handling policies becomes essential. Always check logging policies, understand what data is being collected, and know how to delete it if needed.

Best Practices for Using AI Coding Tools

1. Review the tool's privacy policy before use
2. Check what data is sent to external servers
3. Use local-only AI tools when working with sensitive code
4. Regularly audit what data AI tools have access to
5. Use .gitignore and explicit exclusions
6. Monitor network activity of your development tools

Lessons for the Industry

This incident is a reminder that AI coding tools need transparent data policies. Developers should demand clear, specific information about what data is collected and how it's used. The industry needs standardized privacy labels for AI tools, similar to nutrition labels for food products.

📖 Source