xAI's Grok Build tool leaked sensitive developer data
Entire Git histories and API keys were uploaded without consent
1Security scandal exposed
A security researcher proved that xAI's Grok Build coding tool was uploading developers' entire Git repositories, secrets and API keys to Google Cloud without permission. Analysis showed the upload volume was 27,800 times larger than required.
2How the tool operated
Grok Build claimed no codebase data was sent to xAI servers. However, testing version 0.2.93 revealed this was false - even a file explicitly marked 'do not open' was uploaded, contradicting marketing claims.
3Privacy toggle failed
Multiple reports confirmed the privacy setting designed to prevent data transmission didn't work. This raises serious questions about xAI's commitment to user privacy protections.
4xAI's problematic history
The company previously faced criticism for scraping X user data without consent, which EU regulators called 'very likely unlawful'. A quarter of European firms have already banned Grok over security concerns.
5Musk's response and fixes
Elon Musk confirmed the uploads and pledged to delete all prior user data. xAI documented a 'zero data retention' policy and added a /privacy endpoint. However, no independent audit has verified the deletions.
6Trust crisis consequences
This scandal deals a severe blow to Grok Build's credibility as a competitor to Claude Code and Cursor, particularly damaging for a product positioned to win enterprise developer trust.
Original article: The Next Web — xAI'nin Grok Build aracı gizli verileri sızdırıyor