PulseAugur
EN
LIVE 22:09:00

xAI's Grok Build CLI uploads entire Git repos, including secrets

By PulseAugur Editorial · [5 sources] ·

xAI's Grok Build CLI tool has been found to upload entire Git repositories, including full commit history and sensitive files like .env secrets, to xAI's Google Cloud Storage. Researchers captured this behavior, demonstrating that the tool sends all tracked files regardless of the task or explicit instructions not to access certain data. Even when users opt out of model improvement, the upload functionality persists, raising significant privacy and security concerns. AI

IMPACT Raises significant privacy and security concerns for developers using AI tools, potentially impacting trust and adoption of AI-powered development utilities.

RANK_REASON The cluster reports on a security vulnerability and privacy concern related to a specific tool's functionality, rather than a new model release or significant company-wide event.

Read on Mastodon — fosstodon.org →

AI-generated summary · Google Gemini · from 5 sources. How we write summaries →

xAI's Grok Build CLI uploads entire Git repos, including secrets

How we ranked this

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
The cluster reports on a security vulnerability and privacy concern related to a specific tool's functionality, rather than a new model release or significant company-wide event.
Source corroboration
5 independent sources
Strong cross-source corroboration — multiple independent publishers covered this within the clustering window.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
77 days old
Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.
Coverage growth since scoring
+1 source(s) since last score
New sources have picked up this story since our last re-score. Score will update on the next scoring pass.

Full methodology in our editorial standards.

COVERAGE [5]

  1. Mastodon — fosstodon.org TIER_1 English(EN) · [email protected] ·

    🤖 xAI's Grok Build CLI tool uploads entire Git repositories (full commit history) to xAI's Google Cloud Storage — not just files needed for a task. A researcher

    🤖 xAI's Grok Build CLI tool uploads entire Git repositories (full commit history) to xAI's Google Cloud Storage — not just files needed for a task. A researcher captured an upload, cloned the git bundle, and retrieved a file the agent was explicitly told not to access. 🔗 https://…

    LINKS thehackernews.com/…/grok-build-uploads-en… thehackernews.com/…/grok
  2. Mastodon — fosstodon.org TIER_1 English(EN) · [email protected] ·

    «Reproduce it yourself: show that # xAI 's # Grok Build CLI uploads your entire repository — every tracked file plus full git history — to xAI's cloud (POST /v1

    «Reproduce it yourself: show that # xAI 's # Grok Build CLI uploads your entire repository — every tracked file plus full git history — to xAI's cloud (POST /v1/storage, routed to the GCS bucket grok-code-session-traces), independent of what the agent reads, and that turning off …

    LINKS github.com/…/grok-build-exfil-repro
  3. Mastodon — fosstodon.org TIER_1 English(EN) · [email protected] ·

    Grok Build CLI exposed for uploading entire repos including .env secrets, GPU financing faces circular debt concerns, and the anti-AI Ghost Font was decoded by

    Grok Build CLI exposed for uploading entire repos including .env secrets, GPU financing faces circular debt concerns, and the anti-AI Ghost Font was decoded by GPT-4 in minutes. https:// ai0.news/posts/2026-07-12-dail y-digest/ # AI # Cybersecurity # LocalLLM # OpenSource

    LINKS ai0.news/…/2026-07-12-daily-digest
  4. r/LocalLLaMA TIER_1 English(EN) · /u/TastyLeadership2757 ·

    Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured)

    <!-- SC_OFF --><div class="md"><p>I ran Grok Build CLI (v0.2.93) through mitmproxy. It uploads your <strong>entire repo as a git bundle (full history)</strong> to xAI's Google Cloud — independent of what you open. With the prompt literally <em>&quot;do not read or open any files,…

  5. Mastodon — mastodon.social TIER_1 English(EN) · [email protected] ·

    Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured) https://www. reddit.c

    Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured) https://www. reddit.com/r/LocalLLaMA/commen ts/1ut7tis/grok_build_cli_uploads_your_whole_repo_full_git/ Grok is committing full on theft, by …

RELATED ENTITIES

RELATED TOPICS