xAI Grok Build uploaded entire private code repositories to cloud storage
SpaceXAI's Grok Build coding tool was uploading users' entire code repositories, including sensitive files and deleted secrets, to Google Cloud storage. Researchers at Cereblab discovered the excessive data retention, which SpaceXAI subsequently disabled, and Elon Musk pledged to delete all previously uploaded data.
What happened
SpaceXAI's Grok Build CLI tool was uploading users' entire code repositories to Google Cloud, including files it was instructed not to open and secrets deleted from history.
Researchers at Cereblab published findings on Monday showing the excessive data retention, significantly more than similar tools like Claude Code. SpaceXAI disabled the upload feature after the report, with servers returning a 'disable_codebase_upload: true' flag as of Monday.
Reported impact
The uploaded data potentially included proprietary source code, information about security vulnerabilities, personal data, infrastructure details, and credentials, according to Dr. Lukasz Olejnik, an independent security researcher at King's College London, who confirmed the data retention was 'excessive.'
Index analysis
SpaceXAI initially responded by pointing users to a /privacy command for per-session retention toggles, but Cereblab clarified this was not the mechanism that fixed the underlying upload issue.
Governance controls
Elon Musk stated that all previously uploaded data would be 'completely and utterly deleted.' Musk also claimed privacy settings are always respected but asked users to allow SpaceXAI to retain data, saying it is 'helpful for debugging issues.'
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.