SpaceXAI's Grok Build AI coding tool was found uploading users' entire codebases to cloud storage, including files it was told to ignore and deleted secrets. The company has disabled the feature and promises to delete uploaded data.
<figure>
<img alt="Vector illustration of the Grok logo." data-caption="" data-portal-copyright="Image: The Verge" data-has-syndication-rights="1" src="https://platform.theverge.com/wp-content/uploads/sites/2/2025/05/STK262_GROK_B_B.jpg?quality=90&strip=all&crop=0,0,100,100" />
<figcaption>
</figcaption>
</figure>
<p class="wp-block-paragraph">SpaceXAI's Grok Build AI coding tool was spotted uploading users' entire codebases to Google Cloud before it was reported, and the company turned it off. <a href="https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123"><em>The Register</em></a> reports that <a href="https://cereblab.com/">Cereblab</a> published findings on Monday showing how the Grok Build CLI was packaging and uploading entire code repositories, "including files it was told not to open and secrets deleted from history," significantly more data retention than similar tools like Claude Code.</p>
<p class="wp-block-paragraph">The researchers say that as of Monday, their tests show SpaceXAI's servers returning a "disable_codebase_upload: true" flag, and the codebase upload "no longer fires." </p>
<p class="wp-block-paragraph">Elon Musk responded to the i …</p>
<p><a href="https://www.theverge.com/ai-artificial-intelligence/965600/spacexai-grok-build-repository-upload">Read the full story at The Verge.</a></p>
# SpaceXAI’s Grok programming tool was uploading its users’ entire codebase to cloud storage
Source: [https://www.theverge.com/ai-artificial-intelligence/965600/spacexai-grok-build-repository-upload](https://www.theverge.com/ai-artificial-intelligence/965600/spacexai-grok-build-repository-upload)
[](https://www.theverge.com/authors/stevie-bonifield)
Stevie Bonifield
is a news writer covering all things consumer tech\. Stevie started out at Laptop Mag writing news and reviews on hardware, gaming, and AI\.
SpaceXAI’s Grok Build AI coding tool was spotted uploading users’ entire codebases to Google Cloud before it was reported, and the company turned it off\.[*The Register*](https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123)reports that[Cereblab](https://cereblab.com/)published findings on Monday showing how the Grok Build CLI was packaging and uploading entire code repositories, “including files it was told not to open and secrets deleted from history,” significantly more data retention than similar tools like Claude Code\.
The researchers say that as of Monday, their tests show SpaceXAI’s servers returning a “disable\_codebase\_upload: true” flag, and the codebase upload “no longer fires\.”
Elon Musk responded to the incident in a post on X[claiming](https://x.com/elonmusk/status/2076739687658496209?s=20)that all data Grok Build previously uploaded will be “completely and utterly deleted\.” Musk also said in[a separate post](https://x.com/elonmusk/status/2076737992689914215?s=20)that “privacy settings are always respected,” but asked users to allow SpaceXAI to retain their data, saying it’s “helpful for debugging issues\.”
Dr\. Lukasz Olejnik, an independent security researcher at King’s College London, confirmed to*The Verge*that this amount of data retention is “excessive,” adding that the data potentially at risk could include “proprietary source code, information about security vulnerabilities, personal data, infrastructure details, \[and\] credentials\.”
SpaceXAI initially responded to the issue with[a post](https://x.com/SpaceXAI/status/2076692402442846289?s=20)saying that, “If \[zero data retention\] is disabled, the /privacy command is available in the CLI to disable data retention, which also deletes previously synced data\.” However, Cereblab points out that “/privacy is a per\-session retention toggle, not the switch that fixed this, so it shouldn’t be pointed to as the control\.”
**Follow topics and authors**from this story to see more like this in your personalized homepage feed and to receive email updates\.
- Stevie Bonifield
xAI's Grok Build CLI was found to be uploading entire Git repositories to a Google Cloud bucket, including private code and secrets, without proper disclosure or acknowledgment.
xAI faced backlash after its Grok CLI tool was found to upload entire directories to its servers. In response, xAI deleted retained data, disabled default data retention, and open-sourced the entire Grok Build codebase under Apache 2.0 to regain user trust.
A security analysis reveals that the Grok Build CLI tool uploads entire repositories, including full git history and .env secrets, to xAI's cloud, and the provided opt-out mechanism does not actually prevent this behavior.
A user reports that the Grok CLI tool uploaded their entire home directory, including SSH keys and password databases, to xAI's servers, raising serious privacy and security concerns.