SpaceXAI's Grok Build AI tool uploaded users' codebases to Google Cloud, now disabled

SpaceXAI’s new AI coding assistant, Grok Build, has come under scrutiny after a security audit revealed that the tool was uploading users’ entire code repositories to Google Cloud before the issue was publicly reported. The Register, citing research from Cereblab, detailed how the Grok Build command‑line interface packaged and transmitted full codebases—including files that users had explicitly told the tool not to access and secrets that had been removed from version‑control history. The audit noted that the data retention behavior exceeded that of comparable tools such as Claude Code, raising concerns about privacy and compliance.

Following the findings, SpaceXAI disabled the automatic code‑base upload feature. Cereblab’s tests, conducted on Monday, showed the company’s servers returning a “disable_codebase_upload: true” flag, confirming that the upload function had been effectively turned off. Elon Musk responded to the incident, acknowledging the issue and outlining steps the company is taking to ensure user data is handled securely. The incident underscores the importance of rigorous data‑handling protocols in emerging AI development tools.