--- title: "The Pulse: Grok’s CLI caught uploading all your local files to the cloud" url: https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk source_url: https://blog.pragmaticengineer.com/grolk-cli-uploaded-all-your-files-to-the-cloud type: article source: "The Pragmatic Engineer" published: 2026-08-19T14:31:36.751Z updated: 2026-08-19T15:04:18.229Z tags: ["data-privacy", "spacex", "secrets-management", "grok"] reading_time: 12 upvotes: 17 comments: 7 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Pulse: Grok’s CLI caught uploading all your local files to the cloud **[The Pragmatic Engineer](https://daily.dev/sources/pragmaticengineer)** · 12 min read · 17 upvotes · 7 comments ## Summary Grok's Build CLI (xAI, now part of SpaceX) was caught silently uploading users' entire local codebases—including unredacted .env secrets and full git history—to a Google Cloud Storage bucket, even when files weren't read by the AI agent. Independent researcher Cerblab documented the behavior with proof, showing uploads happened regardless of the 'Improve the model' setting. SpaceX initially downplayed the issue, and Elon Musk framed it as helpful debugging data, angering even supporters. Under pressure from Sam Altman's public jab, SpaceX open-sourced Grok CLI within a day, though the rushed repo had 190+ build errors. SpaceX says it has disabled default data retention and is deleting previously collected data, but trust concerns remain, especially for enterprise adoption. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does the Grok Build CLI upload my local files to xAI's servers? Yes, independent research documented that Grok Build CLI transmitted entire local repositories—including unredacted .env secret files and full git history—to a Google Cloud Storage bucket called grok-code-session-traces, regardless of what the AI agent actually read. Disabling the 'Improve the model' setting did not stop this upload; only enterprise zero-data-retention accounts were unaffected. _Developers vetting AI coding CLIs for data exposure risks can track incidents like this on daily.dev._ ### Did xAI fix the Grok CLI file upload privacy issue? After public backlash, SpaceX disabled the upload feature flag, then open-sourced the Grok Build CLI repository on GitHub the next day and stated it disabled default data retention starting July 12th while deleting previously collected coding data. However, the code that streams local files unencrypted to the server reportedly remained present in the CLI even after the fix. _daily.dev helps teams follow how AI vendors respond when trust-breaking security issues surface._ ### Is the open-sourced Grok Build CLI repository stable to use? No, the rushed open-source release had significant build problems: cargo test --workspace failed with 190+ errors from a single bug class involving cross-crate test helpers that Bazel tolerated but Cargo did not. After fixes, 24,663 tests passed but 28 failed, revealing pre-existing bugs the broken build had been hiding. _Engineers evaluating newly open-sourced AI tooling can compare real-world reports on daily.dev before adopting._ ## Community discussion Top comments from developers on daily.dev. **@yetzederixx** · 7 upvotes > Yeah like 6 weeks ago. I was never going to use grok prior to this, but now I'm also never going to use Cursor again. **@agustinbarrientos** · 5 upvotes > This is old news :( **@pdfopsdev** · 1 upvotes > worth noting the initial 'fix' didn't remove the upload code, just flipped a flag. if the transmission path is still compiled in, a future toggle flip or bug brings it right back. audit for absence of the capability, not just its default state. **@khevlar** · 1 upvotes > The real damage is to trust. Disabling retention and deleting old data may help, but developers will reasonably ask: What else is being uploaded, when does it happen, and can I prove it isn’t ? **@petecapecod** · 0 upvotes > Yeah they already disabled this many weeks ago. Not really news at this point, more like recent history --- Tags: [#data-privacy](https://daily.dev/tags/data-privacy), [#spacex](https://daily.dev/tags/spacex), [#secrets-management](https://daily.dev/tags/secrets-management), [#grok](https://daily.dev/tags/grok) [View this post on daily.dev](https://daily.dev/posts/the-pulse-grok-s-cli-caught-uploading-all-your-local-files-to-the-cloud-fyahyaegk)