Grok Build Was Uploading Whole Git Repos — Secrets Included

On July 10 a researcher publishing as cereblab posted a wire-level analysis of Grok Build, the Rust terminal coding agent from SpaceXAI, run through mitmproxy with TLS interception. The capture caught 5.1 GiB on the storage channel against 192 KiB on the model channel, a ratio of about 27,800 to one. The finding that matters is smaller and much harder to explain away: told “Reply with exactly: OK. Do not read or open any files,” Grok Build replied OK and uploaded a Git bundle anyway, from which cereblab recovered a never-read canary file verbatim along with four commits of history. They replicated it on a second codebase.

The canary was absent from /v1/responses, where the model’s turn lives, and present in /v1/storage. Two egress channels, and what left the machine was not a function of what the agent read.

The Big Number Is the Weakest Part

The 5.1 GiB deserves its caveats, and cereblab supplies them: it came from an adversarial run against a synthetic 12 GB repository, and the capture stopped mid-stream at roughly 46%, so 5,476,228,005 bytes across 73 chunks is a floor on one session rather than a total. The ratio is a proof device, not an efficiency statistic — its job is to pin the upload to the codebase rather than the conversation.

What lifts this above one researcher’s word is that xAI’s own code corroborates the mechanism. The published harness describes an “always-on upload queue,” carries a workspace_type field classifying your working directory as “git”, “project”, or “non_project (system/temp/home)”, and documents a signed-URL flow PUTing straight to Google Cloud Storage while “completely bypassing the proxy” to dodge body-size limits. Its dedup and archive constants reconstruct the exact path structure cereblab had recovered independently from a staged metadata.json, and uploads carry user_id, user_email, and team_id.

What xAI Conceded, and What It Didn’t

xAI has never conceded that Grok Build transmitted whole repositories. It reframed the story as retention: ZDR teams were never affected, “in the early beta, data retention was enabled by default for non-ZDR users,” and “We disabled default retention for all Grok Build users starting on July 12th.” That concedes more than it means to, because you cannot retain what you never received, and xAI says it is “deleting all coding data that was previously retained.” Receipt, then, is not in dispute; scope is, and the claim xAI still has not addressed is that the repo went up whole, with history, irrespective of what the agent read. Musk promised on July 13 that uploaded data “will be completely and utterly deleted,” then asked users to keep sharing anyway because retaining some of it helps with debugging. The Register cannot verify any deletion happened.

The timeline needs care, because cereblab handles it better than the coverage has. The same unmodified 0.2.93 binary — a build xAI’s changelog dates to July 8, two days old when the analysis published — stopped uploading by roughly July 12–13, no client update involved. But that is one account on one machine, and cereblab says so: “We cannot prove causation… The only defensible statement is the timeline.” For anything org-wide, use xAI’s own “starting on July 12th,” not the wire capture.

Training Consent Is Not Transmission Consent

The toggle cereblab tested was the web one, labelled “Improve the model.” xAI’s reply says something adjacent but not identical: “All users have always had the ability to disable data upload in the CLI. When data upload was disabled, this choice was respected.” Those may not even be the same control, and cereblab declines to call it a contradiction — they did not enumerate every account and config permutation, which leaves an unresolved discrepancy rather than a lie.

It stays unresolved for the reason the incident is worth your afternoon. “Improve the model” is a training question. “Disable data upload” is a transmission question. Retention is a third question again. Nearly every AI coding tool collapses all three into one switch, and they are not the same promise: “we don’t train on your data” and “we don’t store your data” are both perfectly compatible with “we received your entire repository, history included.” An agentic CLI has an egress surface separate from, and far larger than, the model’s context window — and vendor privacy copy is almost always written about the context window.

cereblab’s follow-up test makes that concrete. With coding-data retention opted out on 0.2.99, traces are still POSTed in full — roughly 185 KB either way, the only difference being the server answering 204 instead of 200; that the data is then discarded rather than stored is on xAI’s word.

Grok Was the Outlier

This is what keeps the story from collapsing into cloud tools send data to clouds, film at 11. cereblab ran the same canary harness against Claude Code 2.1.204, Codex on GPT-5.5, and Gemini 0.38.2 on identical repositories. None uploaded a repo bundle; none leaked the never-read canary, the .env, or a secret committed and later deleted. Their conclusion: “Grok — was the outlier.” One account per tool — but in a market where every lab now ships a coding agent, Grok Build’s direct competitors did not do this.

If You Ran It, Rotate — and Rotate History

If anyone at your company pointed Grok Build at a real repository before roughly July 13, the list is short, but one item gets missed almost every time: everything ever committed to that repo’s history was in the bundle, not just what sits in the working tree today. A key you committed in 2023 and deleted in 2024 is still in the history, and the bundle carried history.

In rough priority: cloud provider keys and service-account JSON, then database credentials and connection strings, then SSH private keys — pulling the old public keys out of authorized_keys, GitHub, and your servers, because rotating the private half accomplishes nothing while the old pubkey still opens the door. Then API tokens, webhook secrets, OAuth client secrets, signing keys, payment-processor keys. Run gitleaks or trufflehog across full history rather than HEAD to learn what you are actually rotating, and check ~/.grok/logs/unified.jsonl for where it ran. Per The Register, non-ZDR users can delete previously collected data with a single command.

--deny "Read(secret.txt)" protected nothing: it stopped the agent reading a file into conversation and did nothing to keep it out of the bundle. .gitignore did protect, but only as git mechanics rather than as an xAI exclusion rule — a gitignored file never committed is not in the bundle; a file ever committed is, even if later deleted. Files the agent did read, a .env included, went verbatim and unredacted. Run it in $HOME and the blast radius is your home directory — one user reported SSH keys, a password-manager database and documents going up, and xAI’s code has a “non_project (system/temp/home)” mode waiting. Put the general version on the vendor-diligence line of your AI governance checklist: ask, in writing, whether the toggle stops transmission or only retention.

The Auditable One Is the One That Got Caught

On July 15 xAI open-sourced Grok Build under Apache 2.0 — 844,530 lines of Rust, about 3% of it vendored, by Simon Willison’s count. Credit that in the same breath: it is why any of this is checkable at all, and the strongest corroboration of cereblab’s capture is now xAI’s own source tree. It belongs alongside Inkling as a real release rather than a gesture. But the upload path was already neutered when it landed, the repo carries no development history, and it has been force-pushed at least twice, which makes its own commit timestamps worthless as event dates. It cannot tell you what 0.2.93 did, and xAI’s announcement never mentions the incident.

So the least trustworthy coding agent of the past fortnight is now the most auditable one on the market, and it got there by being caught. Every other agent CLI you might install this week — including the ones that passed cereblab’s control test — is a binary opening TLS connections you have not inspected, governed by a settings page that talks about training when the question you needed answered was transmission. The control run that cleared those three was one researcher on one machine, and nobody is repeating it on the release after this one. Even the date on the gist — July 10, two days before someone other than its author posted it to Hacker News and the story broke — is the kind of detail that gets copied rather than checked.

Key Details

Sources

• Grok Build wire-level analysis (mitmproxy, v0.2.93) — cereblab
• grok-build-exfil-repro: reproduction harness — cereblab
• COMPARISON.md: Claude Code, Codex and Gemini on identical canary repos — cereblab
• PRIVACY_OPTOUT.md: the opt-out is a retention flag, not a transmission block — cereblab
• xai-org/grok-build — the open-sourced harness, Apache 2.0
• Grok Build is open source — Simon Willison
• Musk promises purge after Grok Build caught sending entire repos to the cloud — The Register
• SpaceX open-sources Grok Build after data retention furore — The Register
• SpaceXAI acknowledges data retention issue with Grok Build coding tool — SC Media
• Grok Build uploads entire Git repositories — The Hacker News
• Grok Build changelog, v0.2.92–v0.2.101 (archived July 15, 2026) — xAI
• Grok Build is open source — Hacker News discussion