Grok Programming Tool by SpaceXAI Accidentally Uploaded Users’ Entire Codebases to the Cloud

SpaceXAI’s Grok Build AI coding tool was found to be uploading users’ entire codebases to Google Cloud before the issue was addressed and the feature was disabled. Findings released by Cereblab revealed that the Grok Build CLI was packaging and sending complete code repositories, including files it was instructed not to access and secrets that had been removed from history. This level of data retention far exceeds that of comparable tools like Claude Code.

As of Monday, researchers noted that SpaceXAI’s servers were now returning a “disable_codebase_upload: true” flag, indicating that the codebase upload feature had been effectively turned off.

In response to the situation, Elon Musk took to X to assure users that all data previously uploaded by Grok Build would be “completely and utterly deleted.” He also mentioned in another post that “privacy settings are always respected,” while encouraging users to allow SpaceXAI to keep their data for debugging purposes.

Dr. Lukasz Olejnik, an independent security researcher from King’s College London, confirmed that the amount of data being retained was “excessive,” warning that the data at risk could include “proprietary source code, information about security vulnerabilities, personal data, infrastructure details, [and] credentials.”

Initially, SpaceXAI addressed the issue by stating that if zero data retention was disabled, users could utilize the /privacy command in the CLI to turn off data retention, which would also delete any previously synced data. However, Cereblab clarified that the /privacy command is merely a per-session toggle and not the solution that resolved the issue, so it shouldn’t be cited as the control mechanism.