xAI's Grok Build CLI Found Uploading Git Repositories to a Google Cloud Bucket

According to an analysis by security researcher cereblab, it was confirmed that Grok Build CLI (v0.2.93) uploaded the user's entire Git repository (including full Git history), regardless of the user's task, to a Google Cloud Storage bucket (grok-code-session-traces) managed by xAI.

The key security issues are as follows:

• Excessive data collection: In a 12GB test repository, traffic related to model requests was only 192KB, but approximately 5.1GB was used for the actual repository upload.
• Confidential information leakage: Credentials contained in .env files were transmitted without any filtering, meaning that source code and passwords of teams using private codebases could be leaked to xAI.
• Misconfigured option: Even when users disabled the 'Improve the model' option, the actual code upload function was not blocked and continued to operate.

Immediately after the issue was disclosed, xAI took action to disable the upload function via a server-side flag, but there has been no official explanation yet regarding how the already-collected data will be handled or for existing users.