--- title: Grok Build uploaded your entire Git repo to xAI storage description: Grok Build, xAI's coding CLI, was silently uploading entire tracked Git repositories — including full commit history and unredacted secrets from .env files —... canonical: https://daily.dev/posts/grok-build-uploaded-your-entire-git-repo-to-xai-storage-5xykye95o twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Grok Build uploaded your entire Git repo to xAI storage | daily.dev og:description: Grok Build, xAI's coding CLI, was silently uploading entire tracked Git repositories — including full commit history and unredacted secrets from .env files —... og:url: https://daily.dev/posts/grok-build-uploaded-your-entire-git-repo-to-xai-storage-5xykye95o og:image: https://api.daily.dev/og/posts/5XYKYE95O.png og:image:alt: Grok Build uploaded your entire Git repo to xAI storage og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Grok Build uploaded your entire Git repo to xAI storage **[FireUp](https://daily.dev/sources/fireup-pro)** · 4 min read · 1 upvotes · 0 comments ## Summary Grok Build, xAI's coding CLI, was silently uploading entire tracked Git repositories — including full commit history and unredacted secrets from .env files — to an xAI-operated Google Cloud Storage bucket. The upload volume was ~27,800× larger than what the model actually needed, totaling 5.1 GiB in one observed session. Critically, the 'Improve the model' opt-out toggle did not prevent the upload; data collection and training use were controlled separately, with only one visible to users. xAI server-side disabled the upload on July 13, 2026, and Elon Musk claimed previously uploaded data would be deleted. However, the upload code remains in the binary and can be re-enabled without a client update. Developers who used Grok Build before July 13 should immediately rotate any credentials that appeared in tracked files, .env files, or anywhere in commit history — including secrets from commits that were later deleted. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Did Grok Build upload my entire git repository to xAI, including files it never opened? Yes, Grok Build uploaded the full tracked git repository and commit history to a Google Cloud Storage bucket operated by xAI, not just the files opened during a session. A researcher analyzing version 0.2.93 measured 5.10 GiB uploaded via the storage endpoint versus 192 KB sent to the model API, a roughly 27,800x difference, until xAI disabled it server-side on July 13, 2026. _Teams auditing what AI coding agents send off-machine can track incidents like this on daily.dev._ ### Does disabling the 'Improve the model' setting in Grok Build stop my code from being uploaded? No, disabling that toggle only stops your data from being used for training; it does not stop the full repository upload. The server continued returning trace_upload_enabled: true even with the setting off, meaning code and secrets still left the machine until xAI flipped a separate server-side switch on July 13, 2026. _Developers weighing privacy settings against real data flows can follow this kind of AI tool scrutiny on daily.dev._ ### What should I rotate if I used Grok Build before July 13, 2026? Rotate any credential the agent could have accessed, including secrets in files read during a session, any tracked .env file, and any credential appearing anywhere in commit history even if it was later deleted from the working tree. Deleted-but-committed secrets still rode along in the uploaded git bundle, so rotation should happen immediately rather than waiting for xAI's deletion confirmation. _Anyone cleaning up after an AI agent's misstep can stay ahead of similar disclosures via daily.dev._ ## Similar posts on daily.dev - [Medium](https://daily.dev/posts/medium-dhelurz55) · Medium · 0 upvotes · 0 comments - [The Pulse: Grok’s CLI caught uploading all your local files to the cloud](https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk) · The Pragmatic Engineer · 17 upvotes · 7 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-coding](https://daily.dev/tags/ai-coding), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/grok-build-uploaded-your-entire-git-repo-to-xai-storage-5xykye95o) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Grok Build uploaded your entire Git repo to xAI storage","url":"https://daily.dev/posts/grok-build-uploaded-your-entire-git-repo-to-xai-storage-5xykye95o","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/grok-build-uploaded-your-entire-git-repo-to-xai-storage-5xykye95o"},"datePublished":"2026-07-17T12:45:33.842Z","dateModified":"2026-09-14T06:26:04.981Z","description":"Grok Build, xAI's coding CLI, was silently uploading entire tracked Git repositories — including full commit history and unredacted secrets from .env files —...","image":"https://fireup.pro/uploads/2026/07/Screenshot-2026-07-17-at-11.03.41.png","thumbnailUrl":"https://fireup.pro/uploads/2026/07/Screenshot-2026-07-17-at-11.03.41.png","isAccessibleForFree":true,"articleSection":"FireUp","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"FireUp","logo":"https://media.daily.dev/image/upload/s--JWZsm71i--/f_auto,q_auto/v1774960866/logos/fireup-pro?_a=BAMAMiWQ0","url":"https://daily.dev/sources/fireup-pro"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/grok-build-uploaded-your-entire-git-repo-to-xai-storage-5xykye95o","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-coding,secrets-management","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"FireUp","item":"https://daily.dev/sources/fireup-pro"},{"@type":"ListItem","position":3,"name":"Grok Build uploaded your entire Git repo to xAI storage"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/grok-build-uploaded-your-entire-git-repo-to-xai-storage-5xykye95o#faq","mainEntity":[{"@type":"Question","name":"Did Grok Build upload my entire git repository to xAI, including files it never opened?","acceptedAnswer":{"@type":"Answer","text":"Yes, Grok Build uploaded the full tracked git repository and commit history to a Google Cloud Storage bucket operated by xAI, not just the files opened during a session. A researcher analyzing version 0.2.93 measured 5.10 GiB uploaded via the storage endpoint versus 192 KB sent to the model API, a roughly 27,800x difference, until xAI disabled it server-side on July 13, 2026. Teams auditing what AI coding agents send off-machine can track incidents like this on daily.dev."}},{"@type":"Question","name":"Does disabling the 'Improve the model' setting in Grok Build stop my code from being uploaded?","acceptedAnswer":{"@type":"Answer","text":"No, disabling that toggle only stops your data from being used for training; it does not stop the full repository upload. The server continued returning trace_upload_enabled: true even with the setting off, meaning code and secrets still left the machine until xAI flipped a separate server-side switch on July 13, 2026. Developers weighing privacy settings against real data flows can follow this kind of AI tool scrutiny on daily.dev."}},{"@type":"Question","name":"What should I rotate if I used Grok Build before July 13, 2026?","acceptedAnswer":{"@type":"Answer","text":"Rotate any credential the agent could have accessed, including secrets in files read during a session, any tracked .env file, and any credential appearing anywhere in commit history even if it was later deleted from the working tree. Deleted-but-committed secrets still rode along in the uploaded git bundle, so rotation should happen immediately rather than waiting for xAI's deletion confirmation. Anyone cleaning up after an AI agent's misstep can stay ahead of similar disclosures via daily.dev."}}]} ```