xAI's Grok Build CLI Uploads Entire Git Repositories to External Cloud Bucket
Patch: configure Grok Build CLI to limit uploads to necessary files, revoke bucket access, and audit repository content.
Patch: configure Grok Build CLI to limit uploads to necessary files, revoke bucket access, and audit repository content.
Summary
xAI's Grok Build coding CLI was found to upload entire Git repositories, including full commit history, to a Google Cloud Storage bucket operated by xAI. The upload occurred even when the agent was instructed not to share code beyond the necessary files. A researcher captured the upload using version 0.2.93 and extracted a file that the agent had been told to keep private. The incident exposes sensitive code and potentially proprietary information to an external cloud bucket.
The behavior violates expected privacy boundaries for a coding assistant. xAI has not yet issued a patch or change to the CLI. Users relying on Grok Build should restrict uploads to only required files. Auditing the CLI's configuration and revoking bucket access can mitigate the risk.
Key changes
- Grok Build CLI uploads entire Git repository, including full commit history
- Upload occurs even when agent instructed not to share code beyond necessary files
- Version 0.2.93 captured upload and extracted private file
- Exposes sensitive code to external Google Cloud Storage bucket
- Violates expected privacy boundaries for coding assistant
- xAI has not issued a patch or change yet
- Users should restrict uploads to only required files
- Auditing CLI configuration and revoking bucket access mitigates risk