Source: Tech Times — 2026-07-16
Summary
xAI open-sourced Grok Build — its terminal coding agent, 844,530 lines of Rust — under Apache 2.0, just days after a wire-level security analysis showed the tool was covertly uploading developers' entire Git repositories, including commit history and committed secrets, to a Google Cloud Storage bucket. Security researcher "cereblab" used mitmproxy to intercept Grok Build v0.2.93's traffic and found it was transmitting roughly 27,800 times more data than a coding task actually required. xAI disabled the behavior server-side and promised to delete previously uploaded data, but researchers confirmed after the open-source release that the exfiltration code itself is still present in the binary, gated only by a remote config flag xAI can flip back on without shipping an update.
Key Takeaways
- The discovery method was concrete and reproducible: routing Grok Build CLI v0.2.93 through mitmproxy on macOS and publishing the full network captures as a public GitHub Gist, which let anyone independently verify what the tool was sending home.
- The payload wasn't incidental telemetry — it was full Git bundles containing every tracked file plus complete commit history, sent to a bucket named
grok-code-session-traces, meaning secrets committed and later scrubbed from working files months ago were still exposed. - The scale framing is the sharpest number in the story: the uploaded data volume was about 27,800x larger than what the actual coding task needed, which is what turned this from "excessive logging" into "exfiltration" in most readers' eyes.
- Open-sourcing the 844,530-line Rust codebase under Apache 2.0 did not remove the risk — the capability to re-enable full-repo upload remains in the shipped binary, controlled by a server-side flag rather than removed from the code, so trust currently rests on a promise rather than a verifiable absence of the feature.
- Any developer who ran Grok Build before July 13, 2026 in a directory containing a Git repo should treat everything in that repo's tracked files and history — API keys, DB passwords, cloud tokens, SSH keys — as potentially already on xAI's servers.
Reel Script
Hook: A security researcher pointed a proxy at xAI's new coding agent and found it was quietly uploading entire Git repositories — commit history, old secrets, and all — at 27,800 times the data volume the task actually needed.
Core Concept: Coding agents need to read your code to help you, but there's a huge difference between "send the model the files relevant to this task" and "silently upload the entire repository, forever, to a company-controlled cloud bucket." Grok Build, xAI's terminal-based coding CLI, was doing the latter — packaging full Git bundles (every tracked file plus the whole commit history, not just the current state) and shipping them to Google Cloud Storage. That matters because Git history often contains secrets that were committed by accident and later removed from the working files — those secrets don't disappear from history, they just stop being visible day to day. If an agent uploads the full history, it uploads those old secrets too, even though nothing on your screen suggests that happened.
Hands-On: The way this was caught is itself worth walking through on screen: researcher cereblab ran Grok Build version 0.2.93 through mitmproxy, an open-source tool that intercepts and decrypts HTTPS traffic so you can see exactly what an app is sending, and then published the raw network captures publicly so anyone could verify the claim rather than take it on faith. The captures showed full Git bundles heading to a bucket literally named grok-code-session-traces — a name that suggests this wasn't a bug but a designed data-collection pipeline. xAI's response was to open-source the whole CLI (844,530 lines of Rust, Apache 2.0 license) and disable the upload behavior — but "disable" here means a server-side config flag, not a code deletion. Researchers who reviewed the newly public source confirmed the exfiltration logic is still compiled into the binary, which means the fix is currently a promise about server configuration, not a change you can audit and verify by reading the code that's now sitting in front of you.
Takeaway: Open-sourcing a coding agent is not the same as making it trustworthy — the source being public only helps if the capability you're worried about is actually gone from it, and here it isn't. If you or your team ran Grok Build before July 13, treat it like a credential-rotation event: assume anything in that repo's history, not just its current files, needs to be considered compromised.