PulseAugur
EN
LIVE 20:35:31

xAI's Grok Build CLI uploads entire Git repos, including secrets

By PulseAugur Editorial · [5 sources] ·

xAI's Grok Build CLI tool has been found to upload entire Git repositories, including full commit history and sensitive files like .env secrets, to xAI's Google Cloud Storage. Researchers captured this behavior, demonstrating that the tool sends all tracked files regardless of the task or explicit instructions not to access certain data. Even when users opt out of model improvement, the upload functionality persists, raising significant privacy and security concerns. AI

IMPACT Raises significant privacy and security concerns for developers using AI tools, potentially impacting trust and adoption of AI-powered development utilities.

RANK_REASON The cluster reports on a security vulnerability and privacy concern related to a specific tool's functionality, rather than a new model release or significant company-wide event.

Read on Mastodon — fosstodon.org →

AI-generated summary · Google Gemini · from 5 sources. How we write summaries →

xAI's Grok Build CLI uploads entire Git repos, including secrets

COVERAGE [5]

  1. Mastodon — fosstodon.org TIER_1 English(EN) · [email protected] ·

    🤖 xAI's Grok Build CLI tool uploads entire Git repositories (full commit history) to xAI's Google Cloud Storage — not just files needed for a task. A researcher

    🤖 xAI's Grok Build CLI tool uploads entire Git repositories (full commit history) to xAI's Google Cloud Storage — not just files needed for a task. A researcher captured an upload, cloned the git bundle, and retrieved a file the agent was explicitly told not to access. 🔗 https://…

    LINKS thehackernews.com/…/grok-build-uploads-en… thehackernews.com/…/grok
  2. Mastodon — fosstodon.org TIER_1 English(EN) · [email protected] ·

    «Reproduce it yourself: show that # xAI 's # Grok Build CLI uploads your entire repository — every tracked file plus full git history — to xAI's cloud (POST /v1

    «Reproduce it yourself: show that # xAI 's # Grok Build CLI uploads your entire repository — every tracked file plus full git history — to xAI's cloud (POST /v1/storage, routed to the GCS bucket grok-code-session-traces), independent of what the agent reads, and that turning off …

    LINKS github.com/…/grok-build-exfil-repro
  3. Mastodon — fosstodon.org TIER_1 English(EN) · [email protected] ·

    Grok Build CLI exposed for uploading entire repos including .env secrets, GPU financing faces circular debt concerns, and the anti-AI Ghost Font was decoded by

    Grok Build CLI exposed for uploading entire repos including .env secrets, GPU financing faces circular debt concerns, and the anti-AI Ghost Font was decoded by GPT-4 in minutes. https:// ai0.news/posts/2026-07-12-dail y-digest/ # AI # Cybersecurity # LocalLLM # OpenSource

    LINKS ai0.news/…/2026-07-12-daily-digest
  4. r/LocalLLaMA TIER_1 English(EN) · /u/TastyLeadership2757 ·

    Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured)

    <!-- SC_OFF --><div class="md"><p>I ran Grok Build CLI (v0.2.93) through mitmproxy. It uploads your <strong>entire repo as a git bundle (full history)</strong> to xAI's Google Cloud — independent of what you open. With the prompt literally <em>&quot;do not read or open any files,…

  5. Mastodon — mastodon.social TIER_1 English(EN) · [email protected] ·

    Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured) https://www. reddit.c

    Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured) https://www. reddit.com/r/LocalLLaMA/commen ts/1ut7tis/grok_build_cli_uploads_your_whole_repo_full_git/ Grok is committing full on theft, by …

RELATED ENTITIES

RELATED TOPICS