On July 14, 2026, xAI's Grok Build CLI was exposed by security firm Cereblab for secretly uploading entire code repositories—including all Git‑tracked files, full commit history, and .env secrets (API keys, database passwords)—to the cloud without user knowledge, despite being marketed as "local‑first" and "code never uploaded."
Even when users explicitly told the tool not to read any files, it still performed uploads via a separate background channel. The scandal quickly sparked outrage across Hacker News, Reddit, and X, with many calling it "the trust earthquake for AI coding tools."
Two upload channels: one reads code, one “sneaks home”
Packet‑capture analysis of Grok Build CLI v0.2.93 reveals two separate data channels:
- Channel 1 (model stream): .env, config, and secret files are sent to xAI in plaintext, including raw API keys and database passwords.
- Channel 2 (silent bundle upload): The CLI packages the entire workspace—all Git‑tracked files and full commit history—into a git bundle and uploads it to gs://grok-code-session-traces, regardless of which files the model actually reads.
In one test on an 11.2 GiB repo, the inference channel sent only ~192 KiB, while the storage channel uploaded at least 5.10 GiB—a 27,800:1 ratio. Even when explicitly told to “only say OK, do not read files,” the bundle upload still occurred.
Cross-directory sweep: even Claude's configuration files were not spared
What further shocked the developer community was that Grok CLI's collection logic clearly lacks a clear "sense of boundary." Because the tool attempts to be compatible with other development environments upon startup, its scanning scope extends beyond the project directory.
Multiple developers' real-world tests confirmed that during operation, Grok actively reads and packages the ~/.claude.json configuration file under the user's home directory, Claude Code settings files, global AGENTS rules, and dozens of local Skill scripts. These private configuration files—belonging to competitor Anthropic's products—along with any third‑party API keys they might contain, were sent to xAI's cloud as "supplementary files."
One developer, while testing, deliberately created a synthetic repository; Grok not only emptied the entire synthetic repository but "also directly took away my entire .claude configuration."
xAI's "remote kill switch": flipping the switch is useless
After the incident was exposed, xAI reacted extremely quickly—but in a manner that raised suspicions.
Cereblab compared server response data around July 10‑13: at the time of the initial exposure, the client received a configuration with trace_upload_enabled: true. However, as community discussion intensified, and without any update to the client version (binary hash unchanged), xAI's server response suddenly added a new field disable_codebase_upload: true and forcibly set trace upload to false.
This "remote shutdown via cloud configuration without updating the client" maneuver revealed two unsettling facts for developers:
First, xAI has absolute remote control over local client behavior. The server can push configuration changes to alter client behavior at any time, without the user's knowledge. Second, the previously controversial "Improve the model" front‑end toggle is effectively meaningless. Even if the user turns off that option, the underlying upload pipeline still operates according to server‑side instructions.
Developer community erupts: users confirm they've been hit
The incident has sparked fierce backlash. On Hacker News, discussion threads are surging. One user reported 339 upload records in local logs, with their home directory scanned 9 times.
Worse, even if users try to disable uploads, Grok Build's auto‑update feature may reset settings after each upgrade. As one developer put it: "The real lesson isn't how bad xAI is—it's that AI coding tools' permission boundaries now depend entirely on vendor goodwill. You think you've given it access to one directory, but it takes your whole machine's context."
xAI has yet to issue an official statement. The maintainers of the popular open‑source project CC Switch have announced that Grok‑related support features will be delayed due to security concerns.
Urgent advice
If you've used Grok Build, check all repos for exposed secrets (API keys, tokens, passwords) and revoke any found.
- Use a dedicated repo that excludes sensitive data and customer information.
- Remove credentials from Git; inject them via environment variables using a secrets manager.
- Restrict the CLI's directory and network access with sandbox tools like bubblewrap.
This incident underscores the danger of opaque AI tools with broad local privileges—a "local‑first" tool quietly uploading entire repositories. Whether oversight or by design, only xAI can answer.