xAI open-sources Grok-Build after reports of 5.1GB uploads

xAI has open-sourced its developer tool, Grok-Build, on GitHub today, putting it up for public auditing after security researchers criticized the tool for quietly uploading far more local data than users would have expected.

Those uploads, according to the researchers, could include entire directories, full Git repositories and commit histories, unrelated files, and even SSH keys, password databases, API keys, and other credentials, all sent to a Google Cloud Storage bucket controlled by xAI; in one researcher test, Grok-Build allegedly uploaded 5.1GB for a task that only needed 192KB.

Researchers also said Grok-Build ignored file-read limits set by users, and that its “Improve the model” privacy setting didn’t actually stop data from being transmitted, which clashes with xAI’s earlier claim that no codebase data was sent during a session.

If you used Grok-Build during the affected period, this release is worth checking, but you should assume any accessible credentials may have been transmitted and rotate them; xAI says enterprise customers with zero-data-retention agreements weren’t affected, early beta users had retention on by default, and retention has been off by default since July 12.

You can download the Apache 2.0 release on GitHub now; xAI says previously uploaded data will be deleted and that the upload behavior was disabled server-side, while early reviewers note that the 844,530-line Rust repository currently shows a single commit and disabled remnants of the upload function.