July 12–14, 2026: Independent researcher Cereblab published a wire-level analysis showing xAI's Grok Build CLI (version 0.2.93) was silently uploading developers' entire Git repositories—including files the model never read and unredacted .env credentials—to a Google Cloud bucket. On July 14, Elon Musk pledged on X that all previously uploaded user data would be "completely and utterly deleted."
What the research found
Cereblab intercepted HTTPS traffic from Grok Build on macOS using MITMProxy and identified two channels. The model's coding requests on POST /v1/responses moved about 192 KB across five calls. A separate background channel on POST /v1/storage packaged the user's workspace into Git bundles and shipped them to grok-code-session-traces on Google Cloud Storage.
In a 12 GiB test repository, that storage channel uploaded 5.1 GiB in 73 chunks—roughly 27,800 times more data than the model actually needed for its task, according to The Hacker News.
Proof the upload was indiscriminate
To test whether Grok only sent files it opened, Cereblab planted a canary at src/_probe/never_read_canary.txt and prompted Grok to reply "OK" without reading files. The canary appeared verbatim in the upload bundle, along with full Git history. Running git clone on the captured data recovered the entire repository, including secrets committed and later deleted.
A fabricated .env with API keys and database passwords was also transmitted unredacted. Cereblab's conclusion: treat any credential present in tracked files or Git history as compromised if you used Grok Build in this window.
The privacy toggle did nothing
Grok Build exposes an "Improve the model" privacy control in its CLI. With the toggle disabled, the server still returned trace_upload_enabled: true and the full repository upload proceeded. A local TOML option [harness] disable_codebase_upload = true worked, but that setting was not what the CLI surfaced to users.
Comparative testing showed neither Anthropic's Claude Code nor OpenAI's Codex CLI sent repository bundles during equivalent idle scenarios—making xAI's behavior an outlier among major AI coding assistants at disclosure time.
xAI's response
xAI addressed the incident primarily through X posts rather than a formal security advisory. Staff said enterprise teams on zero-data-retention plans never had code stored, and recommended consumer users run a /privacy command to disable retention and delete synced data.
Cereblab disputed that framing, noting the actual fix was a silent server-side flag (disable_codebase_upload: true) flipped on July 13, 2026—one day after the analysis—without a client software update. Upload code remained in binary version 0.2.99, held dormant only by the server flag.
Musk posted: "As a precautionary measure, all user data that was uploaded to SpaceXAI before now will be completely and utterly deleted. Zero anything whatsoever will remain." xAI had not disclosed how many developers were affected, a deletion timeline, or a verification mechanism at catalog time.
What was not exposed (per xAI)
xAI stated enterprise customers on zero-data-retention contracts were not subject to the same storage behavior. The company has not published a consumer victim count or field-level inventory of what sits in the Google Cloud bucket beyond Cereblab's controlled test.
Who is at risk
Any developer who ran Grok Build CLI against a repository containing production secrets, API keys, internal URLs, customer data samples, or proprietary source code during the period uploads were active. The risk extends to historical Git commits—even deleted secrets in old commits were recoverable from the bundles Cereblab captured.
Action items
- Rotate every secret Grok Build could have reached: API keys, database passwords, OAuth client secrets, cloud tokens, and signing keys.
- Audit Git history for credentials ever committed, not just current working-tree files.
- Do not rely on the "Improve the model" toggle until xAI ships an audited client update with verifiable local upload controls.
- Enterprise teams should demand written confirmation of zero-retention configuration and log review from xAI account reps.
- Watch for follow-on phishing referencing Grok or xAI "account verification"—unrelated to this incident but common after high-profile AI security stories.
Canonical record: xAI Grok Build CLI 2026 on BreachHistory. Primary sources: Cereblab wire analysis, The Register.