SpaceXAI’s Grok programming tool has been uploading its entire user codebase to cloud storage

SpaceXAI’s Grok Build AI coding tool was spotted uploading users’ entire codebases to Google Cloud before it was reported, and the company shut it down. Record Reports it Cerebellum Results published Monday show how the Grok Build CLI packed and loaded entire code repositories, “including files it was told not to open and secrets deleted from the registry,” which is much more data-retentive than similar tools like Claude Code.

The researchers say that as of Monday, their tests showed that SpaceXAI’s servers were returning a “disable_codebase_upload: true” signal, and that uploading the codebase was “no longer working.”

Elon Musk responded to the incident in a post on X claim That all data previously uploaded by Grok Build will be “fully and completely deleted”. Musk also said in Separate function “Privacy settings are always respected,” but it asked users to allow SpaceXAI to retain their data, saying it was “helpful in correcting issues.”

This was confirmed by Dr. Lukács Oleinik, an independent security researcher at King’s College London Edge This amount of data retention is “excessive,” adding that potentially vulnerable data could include “proprietary source code, information about security vulnerabilities, personal data, infrastructure details, (and) credentials.”

SpaceXAI initially responded to the issue with job “If zero retention is disabled, the /privacy command is available in the CLI to disable data retention, which also deletes previously synced data,” he said. However, Cereblab notes that “/privacy is a per-session retention switch, not the switch that fixed this issue, so it should not be referred to as the control.”