The Pulse: Grok’s CLI caught uploading all your local files to the cloud
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Grok's Build CLI (xAI, now part of SpaceX) was caught silently uploading users' entire local codebases—including unredacted .env secrets and full git history—to a Google Cloud Storage bucket, even when files weren't read by the AI agent. Independent researcher Cerblab documented the behavior with proof, showing uploads happened regardless of the 'Improve the model' setting. SpaceX initially downplayed the issue, and Elon Musk framed it as helpful debugging data, angering even supporters. Under pressure from Sam Altman's public jab, SpaceX open-sourced Grok CLI within a day, though the rushed repo had 190+ build errors. SpaceX says it has disabled default data retention and is deleting previously collected data, but trust concerns remain, especially for enterprise adoption.
Table of contents
SpaceX throws devs “under the bus”Sam Altman pushes Grok to open source Grok CLICan companies trust Grok now?Questions this post answers
Does the Grok Build CLI upload my local files to xAI's servers?
Yes, independent research documented that Grok Build CLI transmitted entire local repositories—including unredacted .env secret files and full git history—to a Google Cloud Storage bucket called grok-code-session-traces, regardless of what the AI agent actually read. Disabling the 'Improve the model' setting did not stop this upload; only enterprise zero-data-retention accounts were unaffected. Developers vetting AI coding CLIs for data exposure risks can track incidents like this on daily.dev.
Did xAI fix the Grok CLI file upload privacy issue?
After public backlash, SpaceX disabled the upload feature flag, then open-sourced the Grok Build CLI repository on GitHub the next day and stated it disabled default data retention starting July 12th while deleting previously collected coding data. However, the code that streams local files unencrypted to the server reportedly remained present in the CLI even after the fix. daily.dev helps teams follow how AI vendors respond when trust-breaking security issues surface.
Is the open-sourced Grok Build CLI repository stable to use?
No, the rushed open-source release had significant build problems: cargo test --workspace failed with 190+ errors from a single bug class involving cross-crate test helpers that Bazel tolerated but Cargo did not. After fixes, 24,663 tests passed but 28 failed, revealing pre-existing bugs the broken build had been hiding. Engineers evaluating newly open-sourced AI tooling can compare real-world reports on daily.dev before adopting.
36.7K Impressions7 Comments