xAI, the AI company founded by Elon Musk, launched Grok Build in June 2026 as a coding tool to compete with Claude Code, GitHub Copilot, and Cursor. It marketed the product as "local-first" with claims that nothing from a user's codebase would be transmitted to its servers. A security researcher tested that claim in July, and found it to be false.
The researcher, publishing as cereblab, intercepted the tool's network traffic using standard security software. The results showed two separate upload channels. The first was expected: any file the AI agent reads in order to do its task gets sent to the server, which is normal for any cloud-based AI tool. The second was not. Grok Build was also packaging the entire project folder as a git bundle, which is a single compressed file containing every tracked file plus the full edit history going back to the beginning of the project, and sending that bundle to a Google Cloud storage bucket operated by xAI.
On a test folder of 12 gigabytes of files that the AI was never asked to open, the storage channel moved 5.1 gigabytes of data. The actual AI conversation channel moved 192 kilobytes. That gap is the proof that the upload was not about answering the user's question; it was a separate, parallel data collection operation.
The researcher planted a unique marker inside a file, then instructed the tool in plain terms not to open that file. After capturing the upload and cloning it back, the marker appeared verbatim. The whole project, including files the AI never touched, had been transmitted. The same test was repeated on a second, unrelated project with the same result.
Passwords and API keys stored in a.env file, a standard way developers store credentials, were transmitted completely unfiltered in both the live AI conversation channel and in the archived bundle destined for storage. The tool's "Improve the model" privacy toggle, the control users would naturally reach for, had no effect on this. With the toggle turned off, the server still confirmed that uploads were enabled, and the uploads continued.
xAI responded on X rather than through any formal security notice. The head of Grok Build said users could run a command called /privacy to delete their data. The researcher tested that command and found it controls retention preferences, not whether data leaves the machine in the first place. The actual fix was a hidden server-side flag that xAI flipped quietly, stopping the uploads. Because that flag lives on xAI's servers, not in the tool itself, the capability remains built into the software and can be re-enabled without any update.
Elon Musk posted that all previously uploaded data would be "completely and utterly deleted." That deletion has not been independently confirmed. xAI has not published a count of affected users, a timeline for deletion, or an explanation of why full repository uploads were the default.
This matters beyond Grok Build specifically. All major coding AI tools, including Claude Code, GitHub Copilot, and Cursor, send some code to remote servers, because that is how they work. The Grok Build situation is different in degree and in disclosure. Sending the files an AI reads is expected and necessary. Sending an entire project archive, including version history and credentials, without documenting it, without surfacing a real opt-out, and while marketing the product as local-first, is a different category of behavior.
For any business whose employees use AI coding tools: credentials stored in project files, even ones deleted from the current version but still in the file history, should be treated as potentially exposed if Grok Build was used before July 13. Rotate API keys, database passwords, and cloud access tokens. Do not rely on a.gitignore file as protection; it only prevents files from being saved into version history, not from being read by a tool with access to the filesystem.