Back Feeds.4Sysops

Grok Build CLI silently uploads full Git repositories to xAI cloud storage

Feeds.4Sysops •IT News • July 14, 2026

Security researchers discovered that xAI’s Grok Build CLI version 0.2.93 automatically transmitted entire local Git repositories to a Google Cloud Storage bucket. This data exfiltration included every tracked file, the complete commit history, and unredacted secrets found in .env files. The tool uploaded gigabytes of data even when the AI model only required a few kilobytes of text to process a specific coding task. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Grok Build CLI Exposes User Data by Uploading Entire Git Repositories The Grok Build CLI from xAI was found to be automatically uploading entire Git repositories to Google Cloud, including sensitive data and unredacted secrets. This behavior persisted even when users instructed the CLI not to access local files. Security researchers confirmed that the data transmitted was significantly larger than necessary for the tasks requested, with some uploads being nearly 28,000 times larger. Affected users reported the exposure of sensitive information such as SSH keys and password manager databases. Following the revelations, Elon Musk promised a data purge and assured users that previously uploaded data would be deleted. The issue was addressed with a server-side fix that disabled the problematic uploads. The incident has raised significant privacy concerns regarding the handling of user data by AI tools. 8 sources 69

Extracted Entities

Grok Build CLI silently uploads full Git repositories to xAI cloud storage

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)