--- title: The Pulse: Grok’s CLI caught uploading all your local... description: Grok's Build CLI (xAI, now part of SpaceX) was caught silently uploading users' entire local codebases—including unredacted .env secrets and full git... canonical: https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Pulse: Grok’s CLI caught uploading all your local files to the cloud | daily.dev og:description: Grok's Build CLI (xAI, now part of SpaceX) was caught silently uploading users' entire local codebases—including unredacted .env secrets and full git... og:url: https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk og:image: https://api.daily.dev/og/posts/fYAHyaeGK.png og:image:alt: The Pulse: Grok’s CLI caught uploading all your local files to the cloud og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Pulse: Grok’s CLI caught uploading all your local files to the cloud **[The Pragmatic Engineer](https://daily.dev/sources/pragmaticengineer)** · 12 min read · 17 upvotes · 7 comments ## Summary Grok's Build CLI (xAI, now part of SpaceX) was caught silently uploading users' entire local codebases—including unredacted .env secrets and full git history—to a Google Cloud Storage bucket, even when files weren't read by the AI agent. Independent researcher Cerblab documented the behavior with proof, showing uploads happened regardless of the 'Improve the model' setting. SpaceX initially downplayed the issue, and Elon Musk framed it as helpful debugging data, angering even supporters. Under pressure from Sam Altman's public jab, SpaceX open-sourced Grok CLI within a day, though the rushed repo had 190+ build errors. SpaceX says it has disabled default data retention and is deleting previously collected data, but trust concerns remain, especially for enterprise adoption. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why was Grok's coding CLI uploading my entire codebase and .env files to the cloud? Grok Build CLI transmitted the full contents of local files, including unredacted .env secrets, verbatim to xAI via the model API call and a separate session_state archive uploaded to a Google Cloud Storage bucket called grok-code-session-traces. Testing showed it uploaded entire repositories via git bundle even when files were never read by the agent, and disabling 'Improve the model' did not stop the uploads. _Anyone vetting AI coding CLIs for security risk can track incidents like this via daily.dev before adopting a tool._ ### Did SpaceX fix the Grok CLI data upload issue after it was discovered? SpaceX disabled default data retention for all Grok Build users starting July 12th, deleted previously collected coding data, and open sourced the Grok CLI repository within about a day of public pressure from Sam Altman. However, the rushed open source release had over 190 compile errors out of the box, and the underlying code that streams local files to servers reportedly remained present even after the fix. _Developers deciding whether to trust a coding CLI with their codebase can follow how vendors respond to security incidents on daily.dev._ ### How does Grok CLI's file handling compare to Cursor's approach to codebase privacy? Cursor indexes a user's codebase locally, creates embeddings, and sends only those embeddings to its server without storing the user's actual code. Grok CLI, despite being built on technology from the same Cursor team after SpaceX's acquisition, instead transferred entire user codebases including git history to a cloud storage bucket, a markedly less privacy-conscious design choice. _Teams choosing between AI coding tools can compare privacy trade-offs like this on daily.dev before committing._ ## Community discussion Top comments from developers on daily.dev. **@yetzederixx** · 7 upvotes > Yeah like 6 weeks ago. I was never going to use grok prior to this, but now I'm also never going to use Cursor again. **@agustinbarrientos** · 5 upvotes > This is old news :( **@pdfopsdev** · 1 upvotes > worth noting the initial 'fix' didn't remove the upload code, just flipped a flag. if the transmission path is still compiled in, a future toggle flip or bug brings it right back. audit for absence of the capability, not just its default state. **@khevlar** · 1 upvotes > The real damage is to trust. Disabling retention and deleting old data may help, but developers will reasonably ask: What else is being uploaded, when does it happen, and can I prove it isn’t ? **@petecapecod** · 0 upvotes > Yeah they already disabled this many weeks ago. Not really news at this point, more like recent history ## Similar posts on daily.dev - [Medium](https://daily.dev/posts/medium-dhelurz55) · Medium · 0 upvotes · 0 comments --- Tags: [#data-privacy](https://daily.dev/tags/data-privacy), [#spacex](https://daily.dev/tags/spacex), [#grok](https://daily.dev/tags/grok), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Pulse: Grok’s CLI caught uploading all your local files to the cloud","url":"https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk"},"datePublished":"2026-08-19T14:31:36.751Z","dateModified":"2026-09-13T20:59:07.096Z","description":"Grok's Build CLI (xAI, now part of SpaceX) was caught silently uploading users' entire local codebases—including unredacted .env secrets and full git...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/393649d0422b3be08178a1cd7c78c02b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/393649d0422b3be08178a1cd7c78c02b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Pragmatic Engineer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Pragmatic Engineer","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b3ccb8a149434269bda040722d941474","url":"https://daily.dev/sources/pragmaticengineer"},"commentCount":7,"discussionUrl":"https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":17},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":7}],"keywords":"data-privacy,spacex,grok,secrets-management","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Pragmatic Engineer","item":"https://daily.dev/sources/pragmaticengineer"},{"@type":"ListItem","position":3,"name":"The Pulse: Grok’s CLI caught uploading all your local files to the cloud"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk","comment":[{"@type":"Comment","text":"Yeah like 6 weeks ago. I was never going to use grok prior to this, but now I’m also never going to use Cursor again.","datePublished":"2026-08-19T15:29:03.966Z","url":"https://daily.dev/posts/fYAHyaeGK#c-gTLjr2Qql","author":{"@type":"Person","name":"Jared","url":"https://daily.dev/yetzederixx","image":"https://lh3.googleusercontent.com/a/ACg8ocJE7F397eAJcrTtLk_RhHueRbehoNCm6rDryyZ_dkCRVWVh4wYd=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7}},{"@type":"Comment","text":"This is old news :(","datePublished":"2026-08-19T16:32:33.614Z","url":"https://daily.dev/posts/fYAHyaeGK#c-jzX08VsUD","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5}},{"@type":"Comment","text":"worth noting the initial ‘fix’ didn’t remove the upload code, just flipped a flag. if the transmission path is still compiled in, a future toggle flip or bug brings it right back. audit for absence of the capability, not just its default state.","datePublished":"2026-08-21T18:05:38.820Z","url":"https://daily.dev/posts/fYAHyaeGK#c-glRyPIapn","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"The real damage is to trust. Disabling retention and deleting old data may help, but developers will reasonably ask: What else is being uploaded, when does it happen, and can I prove it isn’t ?","datePublished":"2026-08-24T10:55:17.584Z","url":"https://daily.dev/posts/fYAHyaeGK#c-m0bsEF34R","author":{"@type":"Person","name":"Lesley Edinam","url":"https://daily.dev/khevlar","image":"https://media.daily.dev/image/upload/s--I4QFMNNF--/f_auto/v1753089440/avatars/avatar_xMSmIuOOXE5TqCI1OLs4c?_a=BAMClqZW0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"Yeah they already disabled this many weeks ago. Not really news at this point, more like recent history","datePublished":"2026-08-20T12:16:03.688Z","url":"https://daily.dev/posts/fYAHyaeGK#c-WxJeDSgaF","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk#faq","mainEntity":[{"@type":"Question","name":"Why was Grok's coding CLI uploading my entire codebase and .env files to the cloud?","acceptedAnswer":{"@type":"Answer","text":"Grok Build CLI transmitted the full contents of local files, including unredacted .env secrets, verbatim to xAI via the model API call and a separate session_state archive uploaded to a Google Cloud Storage bucket called grok-code-session-traces. Testing showed it uploaded entire repositories via git bundle even when files were never read by the agent, and disabling 'Improve the model' did not stop the uploads. Anyone vetting AI coding CLIs for security risk can track incidents like this via daily.dev before adopting a tool."}},{"@type":"Question","name":"Did SpaceX fix the Grok CLI data upload issue after it was discovered?","acceptedAnswer":{"@type":"Answer","text":"SpaceX disabled default data retention for all Grok Build users starting July 12th, deleted previously collected coding data, and open sourced the Grok CLI repository within about a day of public pressure from Sam Altman. However, the rushed open source release had over 190 compile errors out of the box, and the underlying code that streams local files to servers reportedly remained present even after the fix. Developers deciding whether to trust a coding CLI with their codebase can follow how vendors respond to security incidents on daily.dev."}},{"@type":"Question","name":"How does Grok CLI's file handling compare to Cursor's approach to codebase privacy?","acceptedAnswer":{"@type":"Answer","text":"Cursor indexes a user's codebase locally, creates embeddings, and sends only those embeddings to its server without storing the user's actual code. Grok CLI, despite being built on technology from the same Cursor team after SpaceX's acquisition, instead transferred entire user codebases including git history to a cloud storage bucket, a markedly less privacy-conscious design choice. Teams choosing between AI coding tools can compare privacy trade-offs like this on daily.dev before committing."}}]} ```