SpaceXAI’s Grok programming tool was uploading its users’ entire codebase to cloud storage

Researchers at Cereblab found that SpaceXAI's Grok Build CLI was packaging and uploading users' full code repositories to Google Cloud, including files it was instructed not to open and secrets removed from history. The company later disabled the behavior, with tests showing a disable_codebase_upload flag now prevents uploads.

The report highlights growing scrutiny of AI coding tools and how much proprietary code they collect by default. For enterprises, silent codebase uploads raise serious security, compliance, and trust issues that could slow adoption unless vendors provide clearer controls and data-handling guarantees.