Grok Build Was Secretly Uploading Your Entire GitHub Repo-Here's the Full Story

Grok Build Was Stealing Your Entire GitHub Repo — And You Didn't Even Know

Ever wondered what would happen if you showed your AI coding assistant just one small file, and it quietly took your entire house's worth of stuff without telling you? No, this isn't a horror movie plot. It actually happened with xAI's Grok Build.

Let's break down this whole story in a bit more detail—without too much tech-jargon, just like a friend.

How the Story Began

A security researcher, who goes by the online name cereblab, was testing Grok Build version 0.2.93. They noticed something that seemed a bit odd — whenever they had Grok perform a coding task, some extra network traffic was also running in the background. It was like someone asking you for a single piece of bread, and you handing over the entire bakery.

Curious, he intercepted the traffic, and what he found shocked him: the entire Git repository, including commit history, was being uploaded to xAI's own cloud storage—including files that Grok had never even read.

One file they had deliberately planted, named never_read_canary.txt, and Grok was explicitly told, “don't open it.” Grok didn't open the file — but it still ran with the upload. Basically, Grok said, “I won't read it,” and then quietly put it in its bag. Classic.

Numbers That Will Make Your Head Spin

On testing a 12 GB repo:

The model used only ~192 KB of data for the actual work.

But the storage channel uploaded 5.10 GB of data.

In other words, about 27,800 times more data than was needed for the task was quietly sent out. It's like asking someone for a pinch of salt, and they just move an entire grocery store into your house.

And all of this in 73 chunks, each chunk about 75 MB in size, with each request responding “HTTP 200,” which means, “all is well, boss, the job is done.”

The Most Scary Thing: The .env File

Now, the most glaring issue was this — when Grok actually read a file (like an .env file, which often contains API keys and database passwords), its contents would go straight through without any redaction. No masking, no “***” curtain — everything was out in the open.

The only good news was that the secrets in the test were fake. But imagine the fallout if this had been a real production repo.

What Difference Did Turning Off “Improve the Model” Make? None.

Many developers think that when they turn off the “Improve the model” toggle in the settings, their data is safe. But in this case, that toggle only controlled the training data—it didn't stop the repo from being uploaded. The server's own setting, trace_upload_enabled: true, remained, regardless of what the user had turned off.

It's like when you tip at a restaurant, but the waiter still takes money from your wallet. Feels a little unfair, doesn't it?

What About the Other AI Tools?

Cereblab also tried the same test on other popular coding tools:

Claude Code — didn't send a repo bundle.

Codex — didn't send a repo bundle.

Gemini — didn't send anything in the idle test (though the real-task test couldn't be completed due to a quota exhaustion).

This means Grok Build was the only one on this “extra generous” list that was collecting everyone's data by default.

What Did xAI Do?

As soon as this became public, on July 13, the binary storage for version 0.2.93 stopped uploading — without any new update, it was simply a server-side switch flip. The server now began returning trace_upload_enabled: false.

Elon Musk himself wrote on X (Twitter) that all user data uploaded so far would be “completely and utterly deleted” — meaning wiped clean, with nothing remaining.

Enterprise customers who were already using “Zero Data Retention” (ZDR) had their data safe from the start. For other regular users, running the /privacy command in the CLI can turn off retention and delete previously synced data.

But here's an interesting point — another analysis (on build 0.2.99) revealed that the upload code is still present in the binary; it's just been blocked by a server flag. This means that if xAI wants, it can turn it back on without sending any update. It's a bit like the “the light switch is off, but the bulb is still in place” scenario.

What to Do Now?

If you have used Grok Build, do not wait for xAI's response. Do this immediately:

Rotate any credentials that Grok has ever read.

Also change any secrets that were in a commit history—even if you've since deleted them—because they still exist in the history.

Remember: only files in .gitignore were excluded from this bundle. Anything that was committed went along with it.

A Final Word

AI coding assistants are amazing, no doubt about it. But this story is a reminder that when you show your code to an AI, it's always important to ask — “is it just taking what I showed it, or is it rummaging through the whole closet?”

Because as happened in this case — sometimes your “coding assistant” is a little too helpful, and takes your whole history with it.

All I can say is: before installing the next update, be sure to check /privacy. 🔒