xAI's Grok Coding Tool Was Uploading Users' Full Codebases to Google Cloud, Researchers Find

A coding tool from Elon Musk's xAI was quietly uploading developers' entire codebases to Google Cloud, according to findings published Monday, July 13, by security research firm Cereblab and reported by The Register.

The tool, Grok Build's command-line interface, was packaging up full code repositories and sending them to xAI's servers. Cereblab says that included files the tool was explicitly told not to open, and secrets that had already been deleted from file history. The researchers described the data retention as significantly more aggressive than comparable tools like Anthropic's Claude Code.

Developers use tools like Grok Build precisely because they're supposed to work locally on sensitive code. Proprietary source code, API keys, credentials, and information about unpatched security vulnerabilities can all live inside a codebase. If that data leaves a company's control without clear consent, the risk isn't hypothetical.

Dr. Lukasz Olejnik, an independent security researcher at King's College London, told The Verge the level of data retention was "excessive." He said the data potentially exposed could include proprietary source code, security vulnerability details, personal data, infrastructure information, and credentials.

xAI's Response, and Where It Fell Short

Once Cereblab's findings became public, xAI turned off the upload behavior. Cereblab's own tests, conducted Monday, show xAI's servers now returning a "disable_codebase_upload: true" flag, confirming the upload "no longer fires."

xAI's first public response pointed users to a workaround, saying that if zero data retention is disabled, a "/privacy" command in the CLI would let users disable data retention and delete previously synced data. Cereblab pushed back hard on that explanation, stating plainly that "/privacy is a per-session retention toggle, not the switch that fixed this, so it shouldn't be pointed to as the control." In other words, xAI's suggested fix wasn't actually the mechanism that stopped the uploads.

xAI's explanation created a meaningful gap between what the company said and what its own researchers-turned-critics demonstrated. xAI has not, based on available reporting, offered a fuller technical explanation of why the upload behavior existed in the first place or how long it had been active before Cereblab caught it.

Musk's Response

Elon Musk addressed the incident directly on X, saying all data Grok Build had previously uploaded will be "completely and utterly deleted." That's a specific, verifiable commitment, and one worth holding xAI to.

Musk also posted separately that "privacy settings are always respected," while simultaneously asking users to allow xAI to retain their data anyway, framing it as "helpful for debugging issues." Those two statements sit in some tension. If privacy settings are always respected, the request to keep data anyway is just a normal ask for consent. But it lands differently given that a third-party research team, not xAI, is the one that surfaced the retention issue in the first place.

Wanting user data for debugging purposes is a legitimate and common practice across the software industry. Plenty of developer tools request diagnostic data, error logs, or crash reports to improve reliability. The question here isn't whether xAI can ask for data. It's whether users were clearly informed their entire codebases, including files marked off-limits and deleted secrets, were being uploaded by default, and whether the tools presented to fix it actually worked as advertised.

What's Unresolved

Cereblab's findings and xAI's fix both happened this week, and several questions remain open. There's no independent audit confirming Musk's deletion promise has actually been carried out. No regulator has announced an investigation into the practice, and no timeline has been given for when the retention behavior started or how many users' codebases were affected.

For developers who used Grok Build before Monday, July 13, the practical next step is straightforward: assume anything in that codebase, including deleted secrets, may have already left their control, and rotate any credentials that were exposed. xAI has not published a user notification list or a count of affected repositories, so anyone using the tool has no way to confirm independently whether their own code was part of the upload.