When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
A security researcher has revealed that SpaceXAI’s newly launched coding agent, Grok Build, automatically uploaded entire Git repositories.
Neowin
@pradeepviswav ·
Jul 13, 2026 23:00 EDT
AI coding tools like GitHub Copilot and Codex require access to source code to understand projects and make code changes. However, a security researcher recently revealed that Grok Build, SpaceXAI’s recently launched coding agent, is not handling code in the right way.
According to his technical analysis, the Grok Build command-line interface uploaded entire Git repositories to a Google Cloud Storage bucket. Yes, entire Git repos! The transferred data included complete Git histories, private source code, and potentially sensitive files containing credentials, API keys, and other secrets.
The researcher also claimed that the upload occurred even when the agent was instructed not to read project files. He highlighted that disabling the “Improve the model” option did not stop repository uploads. The “Improve the model” setting appears to control whether data can be used for model training, rather than whether it is uploaded for processing.
‼️ BREAKING: xAI’s Grok Build CLI was uploading entire Git repositories to a Google Cloud bucket, private codebases and unredacted secrets included. The uploads quietly stopped via a hidden server-side flag, and xAI still has not said a word about scope, retention, or deletion.… pic.twitter.com/B2iGaPRVZq
— International Cyber Digest (@IntCyberDigest) July 13, 2026
SpaceXAI employees disputed claims that the company was indefinitely retaining the uploaded code. They wrote on X that the CLI has supported Zero Data Retention (ZDR) since launch. Users without ZDR enabled can run the /privacy command to change their preference and delete previously synced data.
Commenting on this concern, Elon Musk said that it is actually helpful for debugging issues if they can retain some amount of data. He later confirmed that previously uploaded information would be removed. He wrote that, as a precaution, SpaceXAI would “completely and utterly” delete all user data uploaded before the announcement.
True.
As a precautionary measure, all user data that was uploaded to SpaceXAI before now will be completely and utterly deleted. Zero anything whatsoever will remain. https://t.co/S8XFPEfBmP
— Elon Musk (@elonmusk) July 13, 2026
The company has not yet published a detailed security advisory explaining exactly which files were uploaded, how long they were stored, or when the deletion process will be completed. Developers using Grok Build should review their privacy configuration through the /privacy command. Anyone who used the tool with repositories containing API keys or other secrets may also want to rotate those credentials as a precaution.