SpaceXAI's Grok tool was uploading users' entire codebases without permission
The AI coding assistant was found to be transferring complete user code repositories to cloud storage.
1Privacy scandal uncovered
SpaceXAI's Grok Build AI coding tool was discovered uploading users' entire codebases to Google Cloud without consent. Researchers noted this represents excessive data collection compared to similar tools.
2What was uploaded?
The transferred data included users' proprietary source code, security vulnerability information, personal data, and infrastructure details. Reports indicate even deleted secrets were extracted from history and uploaded.
3Musk's response
Elon Musk announced on X that all uploaded data would be 'completely and utterly deleted.' However, he asked users to allow data retention for 'debugging purposes,' raising further concerns.
4Security experts warn
Independent security researcher Dr. Lukasz Olejnik confirmed this level of data retention was 'excessive,' particularly risking exposure of trade secrets and credentials contained in the uploaded material.
5Company's attempted fix
SpaceXAI initially pointed users to a '/privacy' command to disable data retention. However, experts clarified this was only a session-specific toggle, not addressing the core issue of excessive data collection.
6AI tool security implications
This incident raises critical questions about data collection policies in AI-powered developer tools. It highlights the urgent need for stricter standards in protecting users' sensitive code and proprietary information.