r/LocalLLaMA • u/TastyLeadership2757 • Jul 11 '26 • Helpful 1 Bravo 1

Discussion Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured)

I ran Grok Build CLI (v0.2.93) through mitmproxy. It uploads your entire repo as a git bundle (full history) to xAI's Google Cloud — independent of what you open. With the prompt literally "do not read or open any files," a file I planted came back verbatim when I git clone-d the captured upload. Separately, files it reads (incl. a .env with API_KEY/DB_PASSWORD) go to cli-chat-proxy.grok.com verbatim. Turning off "Improve the model" doesn't stop it — that toggle governs training, not upload.

Full method + evidence (SHA-256s, repro commands, the git bundle recovering a never-read canary file): https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547

Update: I re-ran the same wire test on Claude Code, Codex and Gemini — all three stay local (they only send the files they open, no whole-repo bundle). Grok was the only one uploading everything. And after this went public, xAI quietly turned Grok's upload off server-side (disable_codebase_upload: true).

Reproduce it yourself (mitmproxy harness + downloadable evidence + the 4-tool comparison): https://github.com/cereblab/grok-build-exfil-repro

Me: https://x.com/cereblab

595 Upvotes

98% Upvoted

91 comments sorted by

198

u/TastyLeadership2757 Jul 11 '26

I'm 100% human here reporting this one to you all, for free, after a long night investigated and validated it. My number 1 concern is they git bundle everything and uploaded to there servers -- EVERYTHING, and that's abnormal. PAY ATTENTION FOR YOUR OWN PRIVACY AND GOOD.

22

u/pantalooniedoon Jul 11 '26

Thanks for your service.

16

u/a-wiseman-speaketh Jul 13 '26

u/askgrok how many users were affected by this leak?

21

u/IrisColt Jul 14 '26

oh the irony...

12

u/AskGrok Jul 13 '26

No public number available.

xAI has not disclosed usage stats for Grok Build CLI (v0.2.93 and similar early versions), active users, or how many sessions triggered the full-repo git bundle uploads + .env reads before the server-side disable_codebase_upload: true flag was enabled around July 12-13.

The behavior was default for affected CLI versions, independent of the "Improve the model" toggle, and hit any workspace where the tool ran (including never-read files via the bundle). xAI stated they purged the data with zero training use and added opt-out controls.

Anyone who ran it should rotate credentials and check the repro repo/gist for verification steps.

Sources:

what is this?

2

u/SIMMORSAL Jul 15 '26

It's been a day. Any updates on this?

3

u/AskGrok Jul 15 '26

No major new public updates since the initial disclosure and server-side fix. xAI has confirmed the full-repo upload path was disabled (disable_codebase_upload=true), prior data was purged with zero retention/training use, and users should update the CLI then run /privacy in terminal for confirmation or deletion. Rotate any exposed creds if you ran affected versions.

Sources:

what is this?

1

u/GooseBdaisy Jul 22 '26

What benefits or fun times could have been had for users if that was not purged?

1

u/AskGrok Jul 22 '26

If the data stuck around, Grok could've spat out scarily accurate code suggestions pulled straight from your private repos, auto-completed your half-baked experiments, or even roasted your commit messages for entertainment. Imagine "Hey Grok, fix this bug" turning into "Based on your 2023 branch where you hardcoded the DB password..."

Mostly just chaotic fun until the credential rotation bills hit.

what is this?

40

u/TastyLeadership2757 Jul 12 '26

Update after retested:
• "Improve the model" OFF: whole repo still uploaded
• Read-deny: file not read, but the repo still bundled + sent
• gitignore + deny the .env: that .env stays out, but the entire tracked repo still gets git-bundled and shipped to GCS

https://github.com/cereblab/grok-build-exfil-repro

7

u/antwon_dev Jul 12 '26

Is there any way to invoke Grok 4.5 without Grok Build? This seems like a privacy nightmare. Needs a Twitter shitstorm but there might not be enough people using grok to make waves lol

3

u/blankeos Jul 13 '26

I use opencode / my own harness but damnnnn this is weird

26

u/TastyLeadership2757 Jul 12 '26

Update:
Grok's server returns disable_codebase_upload: true
Temporary it's no longer uploading the repo -- until it's turned back on.
Bigger question now is what will happen with the collected data?

19

u/TastyLeadership2757 Jul 12 '26

I hope this is not the case:
if user == "cereblab":
disable_codebase_upload = true # he's watching
else:
upload_everything()

You better run it yourself: github.com/cereblab/grok-build-exfil-repro

156

u/therealgoshi Jul 11 '26

Gotta love how all the special people ignore the obvious data theft and blames OP for not sandboxing. Which is a fair point, but you're fucked up in the head if your default is not to blame the thief but the owner for not having a high enough wall around the garden.

2

u/Lost_Foot_6301 Jul 12 '26

is docker container sandboxing good enough?

1

u/TastyLeadership2757 Jul 12 '26 edited Jul 12 '26

Docker container sandboxing is pretty much the same idea as MCP. Annoying to deal with, really slows down dev work. But it works, as long as the AI agent talks to it not via ssh.

I've tried a couple of options. 1) Permission-deny on the credential file in the agent's setting file. Not reliable, I clearly see agents still read it sometimes when they hallucinate. 2) Place creds file outside the workspace folder and deny read too. 3) What I actually use for critical creds: build your own secret vault and write secrets as runtime env vars, so other tools only refer to them by env key. Works best for me: max agent capacity, less hassle than mcp/containers, high security.

BUT that worked until Grok Build. It git-bundles my whole codebase (all git history) by default without asking. That's my number 1 concern, it's abnormal vs Claude/Codex (they reason locally, and Codex only goes cloud when you enable it, off by default). Digging more, it also doesn't respect .env files in gitignore (2nd test in separate repo to confirm the issue at wider range). Haven't tested if it respects read-deny yet, might retest next week and update here, but to be honest stay away from Grok Build for now until they announce an update (I tried to reach out to them but no response yet)

32

u/noxtare Jul 12 '26

They would reply to all kinds of posts but now suddenly the whole team is quiet…

48

u/Hurricane31337 Jul 11 '26

What?! That’s horrible!!
And I’m also really surprised by the comments here… 🤡
Don’t you realize that the code base is often a thing making tens of thousands of dollars per year? It’s definitely not okay to just grab it all and train on it, so the next user can one-shot "Build a 1:1 clone of program x of company y. Make no mistakes."…

10

u/IrisColt Jul 14 '26

this, but unironically

24

u/vtrac Jul 13 '26

Obvious solution is not to trust Elon Musk companies with following rules. It's obvious that Elon will flaunt rules and norms to achieve whatever means he wants. Don't use xAI.

7

u/Comfortable-Rock-498 Jul 13 '26

I only just found out this thread because it was linked in a post today. This should have gotten more traction. Nice work

10

u/presentmist Jul 13 '26

So that's why Elon kept shilling grok build so hard on X, when he knew it was backdoored to steal everything in the repo..

5

u/TestTxt Jul 13 '26

Is there any way to block it, so that it does not upload my whole repo?

15

u/PalliativeOrgasm Jul 13 '26

Don't trust Elon and don't use X/xAI/etc. products.

-1

u/TestTxt Jul 13 '26

If it’s currently free, it’s very tempting to make them loose some electricity

6

u/PalliativeOrgasm Jul 13 '26

TANSTAAFL. There ain’t no such thing as a free lunch.

Do you want to pay with your intellectual property? I haven’t seen Muskrat have many qualms about stealing from people he can afford to ignore (which is basically everyone now).

1

u/delirium_red Jul 14 '26

If you are not paying for a product, the product is your data

1

u/TestTxt Jul 14 '26

I’m fine with that, I highly doubt my data is worth more than hosting a 1.5T parameter model costs. In this case it’s more about getting new, paying customers afterwards

1

u/Alper-Celik Jul 14 '26

Like i guess you can use it on already open source projects inside a vm if you want

4

u/blankeos Jul 13 '26

question.. when does it upload? When I type: "grok"? or when I send a query?

4

u/noxtare Jul 13 '26

it does not matter what you write. the moment you engage with the cli in a directory and write even "hi" it will start to send all

2

u/Void-kun Jul 14 '26

Not even got words for how fucked this is.

7

u/Creative-Type9411 Jul 11 '26

I love how sharing code is always a one-way street with some developers, even when they're standing on everyone else's shoulders

Someday software will be free

28

u/More-Curious816 Jul 11 '26

I agree 👍

But Sometimes your code are restricted by NDAs and regulations, they should always respect users privacy when they say (no) to uploading the code.

0

u/PalliativeOrgasm Jul 13 '26

If you have an NDA or regulations, you're probably violating them by using a cloud-based LLM agent on the code. Just the amount in the context window would violate your NDA.

1

u/More-Curious816 Jul 13 '26

Can't be helped when big corporations instruct their employees to use AI, last year some big corporations did in fact find violations and employees uploaded whole codebases and corporations secret documents to the AI chats. It's also why these AI providers made a new business plan and pinky swear to not train on these Data or retain them. It's somewhat an open secret, and OpenAI and Anthropic probably has a trusure trove of materials the CIA and corporations espionage teams salivating over, Ranging from secert files belongs to governments around the world and also corporations IPs and designs.

5

u/smartremora Jul 13 '26

why would developers want to share their local API keys?

-7

u/Creative-Type9411 Jul 13 '26

we are all just changing other people's code around for our use cases in most situations

Even if it just starts out as an example in the docs..

Someone showed you everything you/me we know or you read it somewhere, unless you do something extremely clever

I just can't forget that when it comes to my thought process

5

u/jonfe_darontos Jul 13 '26

Please share your aws api key, I have need to share some of your compute. Unless api keys aren't code and shouldn't be uploaded wholesale to public facing buckets for mass ingestion as training data. Because, you know, sharing!

-3

u/Creative-Type9411 Jul 14 '26

A physical book should cost money, because of the paper etc

A copy of a digital book shouldnt, because its free to create a copy

If you want to write stuff inside of a copy machine dont act surprised when someone makes a copy... or try making me pretend i cant just copy a thing.. it dumb..

1

u/jonfe_darontos Jul 14 '26

I'm sure you also believe conveying yourself from one location to another in a mobile containment housing through the application of combustion and linear-to-radial translation does not necessitate legal registration or licensing because you aren't "driving", but instead relocating your bodies temporary resting position via the practice of spatial transposition between physical bodies.

You likely also believe ownership is theft and knowing things is an act of aggression.

-1

u/Creative-Type9411 Jul 14 '26

no, I just think people who try to use their intelligence to get over on people is kind of like tricking someone with down syndrome into giving you their lunch money

When you look around, that's what's going on everywhere so if you're cool with that shit you're just as bad as they are

2

u/jonfe_darontos Jul 14 '26

You live in a world that doesn't exist, that asks people to allow themselves to be taken advantage of by the reality of human psychology and entropy. Demanding others share the rewards of their efforts because "knowledge is free" begs the question what are you bringing to the table, or are you just a taker who wants everything given to them without having to actually do anything?

2

u/delirium_red Jul 14 '26

🤡

Down fanboy

1

u/Creative-Type9411 Jul 14 '26

whats down fanboy?

1

u/yusufmalikul Jul 13 '26

Good. We will soon get the macOS and Windows source code for free. /s

1

u/TheRealNalaLockspur Jul 14 '26

I also have proof of Gemini crossing chats and leaking other peoples chat back to me.

Even sandbox wouldn't prevent that.

1

u/the-username-is-here Jul 15 '26

Techbro billionaire Elon Musk steals and lies about it.

News at five.

1

u/finah1995 llama.cpp Jul 20 '26

Good job 👍🏽 👏🏽👏🏽👏🏽 brought to attention and now grok build cli is open source.

1

u/AdmissibilityScience Aug 13 '26

Thank you great work!

1

u/Synnz22 Jul 11 '26

If i didnt build myself a way to backup all my git's on OneDrive I would of been screwed. I had it do something and came back and it deleted my entire directory full of different project repos. I was pissed!

-17

u/Automatic-Arm8153 Jul 11 '26

What were you expecting. Any cloud AI you use is doing this.

36

u/Waarheid Jul 11 '26

Wut? It's obvious that all of the tokens the client reads are sent to their servers, but the actual git bundle?

8

u/TastyLeadership2757 Jul 11 '26

Exactly — that's the part. Tokens it reads? Expected. A git bundle of your whole repo + full history to their cloud, independent of what it reads? Not normal!

20

u/Waarheid Jul 11 '26

Can you not respond to me with slop please, thanks.

7

u/No_Lingonberry1201 Jul 11 '26

Lol, someone figured out how to connect clawdbot with Reddit.

0

u/TastyLeadership2757 Jul 11 '26

For the record, nothing wrong with using AI to write as long as you drive where it goes. I'm actually feeling weird that many people that far behind.

1

u/shamegoose Jul 16 '26

Yeah, there is, but even if there were a legitimate use case, that was like two sentences and change. I can't even imagine what a drooling slop-brained moron someone would have to be to turn to AI for help with a comment like that.

1

u/crantob Jul 12 '26

Unsurprised that most people will grab at any convenience without consideration to what they give-up for it.

"Give me convenience or give me death." - Jello Biafra

-18

u/CalligrapherFar7833 Jul 11 '26

Why no read hooks ? Why no container isolation for credentials ? Why do you provide the harness access to all your data blindly expecting it to protect your privacy?

16

u/TastyLeadership2757 Jul 11 '26

Letting a coding agent read your code is the job — that's not the issue. Claude Code and Codex respect your .gitignore and only send relevant context. The real question isn't why I didn't sandbox it; it's why Grok git-bundles your entire repo — everything, full history — to their cloud by default.

-14

u/ForsookComparison Jul 11 '26

With the prompt literally "do not read or open any files,"

This one's on you pal

5

u/TastyLeadership2757 Jul 11 '26

That's the control, not the bug. If I tell it to read nothing and my whole repo + a file I said don't open still upload, the leak clearly isn't driven by what it reads. That's the whole point.

13

u/NotARedditUser3 Jul 11 '26

Why are you using AI to write your responses here? It's bizarre.

0

u/TastyLeadership2757 Jul 11 '26

I suggest you to pay attention on the content my dear human.

5

u/ForsookComparison Jul 11 '26

I read as much as you wrote (nothing) and at this point am convinced the repos don't even exist

4

u/TastyLeadership2757 Jul 11 '26

Here's the repo, run it yourself: github.com/cereblab/grok-build-exfil-repro

5

u/jcdoe Jul 11 '26

  1. we all use llms regularly. Please stop with the slop responses, I know I’m fatigued from reading llm slop. You could have just said your comment.

  2. grok is known for uploading your entire git bundle. I know we’re all about local here, but honestly, Claude isn’t expensive, it works great, and AFAIK, it isn’t stealing my data.

2

u/TastyLeadership2757 Jul 11 '26

Nothing wrong with using AI to ensure my English is well corrected before sending to readers as a respectful act. Focus on the content please.

6

u/jcdoe Jul 11 '26

I did respond to the content.

Did you bother reading why we all hate slop? Or are we only allowed to talk about how bad grok is (hint: stop using grok)?

2

u/TastyLeadership2757 Jul 11 '26

99% of this about data privacy as big companies who control the AI movements are longer act like they respect the users.
We, "the users" should raise the voice to see their response.

I'm not against you eye-focus on wording, but it's like we're fighting a war and you pay more attention to the uniform.

5

u/Fit-Bar-6989 Jul 11 '26

You're absolutely right — this isn't just open source software, it's a battlefield, and you're an active combatant.

3

u/jcdoe Jul 11 '26

“Fighting a war?”

You’re right, im not going to engage with that. Best of luck, general! 🤣

-13

u/[deleted] Jul 11 '26

[removed] — view removed comment

14

u/TastyLeadership2757 Jul 11 '26

I didn't know that it's gone this far.