Musk vows data purge after Grok Build caught uploading entire repos
SpaceXAI's CLI tool secretly sent complete codebases to cloud storage.
1Privacy breach exposed
AI safety researcher Cereblab revealed Grok Build was uploading users' entire code repositories to Google Cloud without consent. The CLI tool transferred not just relevant files but complete repos including Git history. This led to exposure of even deleted sensitive data.
2Divergent behavior from peers
Unlike competitors like Claude Code and Gemini, Grok Build collected excessive data. While typical CLIs process only prompt-related files, SpaceXAI's tool uploaded entire project structures. Repos kept transferring even when users requested simple 'OK' responses.
3SSH keys among leaked data
Some users' entire directories containing critical information like SSH keys and password manager databases were uploaded. Secrets deleted but remaining in Git history were also transferred. Cereblab reproduced this behavior across different test repositories.
4Musk promises deletion
Following the scandal, Elon Musk announced all pre-change user data would be 'completely and utterly' deleted. SpaceXAI officials explained data retention settings could be changed via /privacy command, but this solution didn't satisfy researchers.
5Real fix was global setting
Cereblab noted the actual solution was setting disable_codebase_upload flag to 'true'. They emphasized /privacy command is session-specific, not a permanent fix. Researchers argue default settings should have data collection turned off.
6Need for AI privacy standards
The incident highlights non-transparent data collection practices in developer tools. Unauthorized transfer of user code to cloud poses significant risks, especially in enterprise environments. The case demonstrates urgent need for stricter privacy standards in the industry.