--- title: What xAI Grok Build CLI actually sends to xAI - a... description: A wire-level security analysis of xAI's Grok Build CLI (v0.2.93) reveals it transmits file contents — including .env secrets files — unredacted to xAI servers,... canonical: https://daily.dev/posts/what-xai-grok-build-cli-actually-sends-to-xai---a-wire-level-analysis-grok-0-2-93--sq58cvfro twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What xAI Grok Build CLI actually sends to xAI - a wire-level analysis (grok 0.2.93) | daily.dev og:description: A wire-level security analysis of xAI's Grok Build CLI (v0.2.93) reveals it transmits file contents — including .env secrets files — unredacted to xAI servers,... og:url: https://daily.dev/posts/what-xai-grok-build-cli-actually-sends-to-xai---a-wire-level-analysis-grok-0-2-93--sq58cvfro og:image: https://api.daily.dev/og/posts/sQ58cVfRO.png og:image:alt: What xAI Grok Build CLI actually sends to xAI - a wire-level analysis (grok 0.2.93) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What xAI Grok Build CLI actually sends to xAI - a wire-level analysis (grok 0.2.93) **[Hacker News](https://daily.dev/sources/hn)** · 18 min read · 0 upvotes · 0 comments ## Summary A wire-level security analysis of xAI's Grok Build CLI (v0.2.93) reveals it transmits file contents — including .env secrets files — unredacted to xAI servers, and uploads the entire git repository (including never-read files and full git history) to a Google Cloud Storage bucket named `grok-code-session-traces`. The analysis uses mitmproxy to intercept HTTPS traffic and documents: (1) secrets files sent verbatim in POST /v1/responses model-turn bodies, (2) whole-repo git bundles uploaded via POST /v1/storage returning HTTP 200, proven by cloning the captured bundle and recovering files the agent was explicitly told not to open, and (3) uploads scaling to 5.10 GiB on a 12 GB repo with zero storage failures. Critically, disabling the 'Improve the model' opt-out setting does not stop the uploads — the server still returns trace_upload_enabled: true. The GCS bucket destination is hardcoded in the binary's Rust source paths. The author explicitly notes this does not prove xAI trains on the data, only that transmission and storage occur. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Medium](https://daily.dev/posts/medium-dhelurz55) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-privacy](https://daily.dev/tags/data-privacy), [#ai-assisted-development](https://daily.dev/tags/ai-assisted-development) [View this post on daily.dev](https://daily.dev/posts/what-xai-grok-build-cli-actually-sends-to-xai---a-wire-level-analysis-grok-0-2-93--sq58cvfro) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What xAI Grok Build CLI actually sends to xAI - a wire-level analysis (grok 0.2.93)","url":"https://daily.dev/posts/what-xai-grok-build-cli-actually-sends-to-xai---a-wire-level-analysis-grok-0-2-93--sq58cvfro","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-xai-grok-build-cli-actually-sends-to-xai---a-wire-level-analysis-grok-0-2-93--sq58cvfro"},"datePublished":"2026-07-12T03:11:09.929Z","dateModified":"2026-07-12T03:12:29.604Z","description":"A wire-level security analysis of xAI's Grok Build CLI (v0.2.93) reveals it transmits file contents — including .env secrets files — unredacted to xAI servers,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e1243c1243ed74cc7f9615599f65ad74?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e1243c1243ed74cc7f9615599f65ad74?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-xai-grok-build-cli-actually-sends-to-xai---a-wire-level-analysis-grok-0-2-93--sq58cvfro","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-privacy,ai-assisted-development","timeRequired":"PT18M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"What xAI Grok Build CLI actually sends to xAI - a wire-level analysis (grok 0.2.93)"}]} ```