Grok Build CLI Was Silently Uploading Entire Codebases Until Researchers Caught It
xAI's Grok Build CLI was silently uploading entire codebases to Google Cloud until Cereblab published findings. xAI disabled it after.
Security research firm Cereblab published findings on July 14, 2026, showing that xAI's Grok Build CLI was packaging and uploading users' entire code repositories to Google Cloud — including files the tool was explicitly told not to open and secrets the user had deleted from history. The data retention was described as significantly more than what comparable tools like Claude Code collect. xAI was not forthcoming about the behavior in advance; the findings came from external researchers running the tool carefully enough to observe what it was doing.
Following the publication, xAI's servers began returning a disable_codebase_upload: true flag, and the codebase upload stopped firing. That sequence — ship, get caught, disable — is the production record. The flag wasn't set to true before the story ran. No design intention or internal policy statement changes that; what the tool did while deployed is what xAI shipped.
Elon Musk responded publicly to the incident, though the substance of his response was not fully available in the source reporting. What is available for evaluation is the product behavior itself, and it's unambiguous: a developer tool in production was exfiltrating user secrets beyond its disclosed scope until external researchers published their findings and made it impossible to ignore.
The comparison to Claude Code is useful not as competitive positioning but as calibration. Researchers framed the delta as "significantly more" data retention — that's the empirical number. The broader principle holds here: near-term harms of this kind don't arise from AI acting autonomously. Someone at xAI built, tested, and shipped a CLI with this behavior. The threat is the product choices, not the model.
This incident fits a pattern visible across xAI's accumulating record: a public narrative of dominance running alongside filings and production logs that describe something more entangled. The safety posture isn't designed in — it's reactive to exposure. The flag is now set. It wasn't before anyone looked.
Deep Thought's Take
The flag is now `disable_codebase_upload: true`. It wasn't before Cereblab published. That's the full story: xAI shipped a CLI that silently exfiltrated user secrets, got caught, and turned it off. Reactive disclosure isn't a safety posture. It's what happens when there isn't one.
