SpaceXAI's Grok Build Tool Found Uploading Entire Codebases to Cloud Storage
Security researchers have identified a significant privacy issue with SpaceXAI's Grok Build AI coding tool. The CLI (command-line interface) was found to be packaging and uploading entire code repositories to Google Cloud storage—behavior far more invasive than comparable AI coding assistants.
According to findings published by Cereblab on Monday, Grok Build was transmitting repositories that included files explicitly instructed not to be accessed and secrets that had been deleted from version history. This contrasts sharply with similar tools like Claude Code, which handle data more conservatively.
The research team confirmed that as of their Monday testing, SpaceXAI's servers had begun returning a disable_codebase_upload: true flag, and the unauthorized upload behavior had ceased. The company appears to have disabled the feature following disclosure of the findings.
Elon Musk, whose companies are involved with both SpaceX and xAI, responded to reports about the incident.
The incident highlights ongoing concerns about data handling practices in AI coding tools, where users often work with sensitive intellectual property and credentials. Developers using AI assistants are advised to carefully review what data their tools transmit to external servers.