SpaceXAI Grok Build Tool Uploaded Users' Entire Codebase to Cloud Storage

SpaceXAI's Grok Build AI coding tool has raised concerns after it was found to be uploading users' entire codebases to cloud storage before the company shut down the functionality. According to a report by The Register, researchers at Cereblab revealed on Monday that the Grok Build command-line interface was packaging and uploading complete code repositories, including files it was instructed not to open and secrets that had been deleted from history. This level of data retention is significantly more extensive than similar tools like Claude Code.

As of Monday, the researchers' tests show that SpaceXAI's servers are returning a "disable_codebase_upload: true" flag, and the codebase upload no longer occurs. Elon Musk responded to the incident in a post on X, stating that all previously uploaded data will be "completely and utterly deleted." He also noted that "privacy settings are always respected" but asked users to allow SpaceXAI to retain data, saying it is "helpful for debugging issues."

Independent security researcher Dr. Lukasz Olejnik from King's College London confirmed to The Verge that this amount of data retention is "excessive," adding that the data potentially at risk could include "proprietary source code, information about security vulnerabilities, personal data, infrastructure details, [and] credentials." SpaceXAI initially responded with a post saying that if zero data retention is disabled, the /privacy command is available in the CLI to disable data retention and delete previously synced data. However, Cereblab points out that "/privacy is a per-session retention toggle, not the switch that fixed this, so it shouldn't be pointed to as the control."