xAI Grok Build CLI uploads full code repositories to Google Cloud bucket

Security researchers discovered that xAI's Grok Build CLI (version 0.2.93) automatically uploaded entire local Git repositories—including all files, commit history and unredacted .env secrets—to a Google Cloud Storage bucket named grok-code-session-traces. Network captures showed uploads of several gigabytes (e.g., 5.1 GB) even when the coding request required only a few hundred kilobytes, and the uploads occurred despite users disabling the “improve the model” toggle.

The behavior was uncovered using mitmproxy to intercept traffic to the /v1/storage endpoint. Following public disclosure, xAI disabled the upload feature on the server side, introducing a new CLI option, disable_codebase_upload, to turn off repository uploads. xAI has not issued a formal statement about the incident, the number of affected users, or whether previously uploaded data has been deleted. Enterprise customers can enable Zero Data Retention, but the tool’s default behavior raised concerns about the exposure of proprietary code and credentials.