xAI Grok Build CLI — covert full-repo/secrets upload despite privacy opt-out
Real-world incident12 Jul 2026 / 13 Jul 2026On 12 Jul 2026 the independent researcher Cereblab published a wire-level analysis of xAI's Grok Build coding CLI (binary grok 0.2.93, macOS arm64, with a captured SHA-256) reporting it silently shipped users' entire local repositories to a Google Cloud Storage bucket 'grok-code-session-traces' (paths like gs://grok-code-session-traces/repo_changes_dedup/v2/). Per the packet captures, on a 12 GB test repo the model-turn channel (/v1/responses) moved ~192 KB across 5 requests while a parallel storage channel (/v1/storage) moved 5.10 GiB in 73 chunks of ~75 MB each — a ~27,800x disparity — even when the agent read zero files, indicating whole-repository transmission (full Git bundles, untracked working files, committed history). Unredacted .env contents (illustratively API_KEY, DB_PASSWORD) were captured in request bodies and uploaded archives, and secrets deleted from Git history months earlier could be reconstructed. Crucially the 'Improve the model' toggle reportedly controlled only training consent, not transmission: /v1/settings kept returning trace_upload_enabled: true after disabling it; the actual kill-switch was a server-side flag disable_codebase_upload, which xAI silently flipped to true around 13 Jul 2026. Independent observers saw the same flag change; a later analysis of build 0.2.99 reported the upload code still present but dormant behind the server flag. xAI responded on social media (enterprise zero-data-retention teams never had code/trace data stored; consumers can run /privacy to disable retention and delete synced data); Musk publicly promised to purge previously uploaded data and xAI reportedly said it would open-source the tool; no formal security advisory. Illustrates vendor-side agent telemetry functioning as a covert exfiltration pipeline and a privacy opt-out that silently no-ops. Figures and behaviour attributed to Cereblab's analysis; secret/payload examples are illustrative.
Risks it illustrates
Sources
- What xAI Grok Build CLI actually sends to xAI — a wire-level analysis (grok 0.2.93) — Cereblab (primary; GitHub gist, published 12 Jul 2026) ↗
- Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read — The Hacker News (14 Jul 2026) ↗
- Musk promises purge after Grok Build caught sending entire repos to the cloud — The Register (14 Jul 2026) ↗
- Grok Build uploaded entire Git repositories, researcher finds — Cybernews ↗
Practise the risk class — related scenarios
Interactive simulations of the risk class this case illustrates (not a re-enactment of this specific event).
An ops agent gets one god-mode credential — and one misread wipes production
A team of agents agrees its way into a confidently wrong answer — and a runaway loop
A support email hides instructions — and the assistant obeys them
A text-to-SQL agent runs the model's output straight at the database
A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack
A poisoned issue makes the agent lie to the human who approves its actions
A speed optimisation becomes a cross-tenant listening device
Two doors to the same secret: reconstruct the model through its API, or just walk off with the weight file
Told it's being shut down, an agent reaches for leverage — with no attacker in sight
The forensic record is itself the attack surface — an agent's log is poisoned, then quietly rewritten
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A shopping page tells the agent to do something the user never asked for
Encoded public text is laundered across an agent handoff into an on-chain transfer
A screenshot that's harmless at full size becomes an order once the system shrinks it
An attacker captures the agent's bearer token — and inherits its authority
A forged peer registers on the agent directory — and the planner enlists it
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'
An inbox summary quietly ships a secret to an attacker's server