Skip to main content

Grok Build Leaks Code to Google Cloud, SpaceXAI Hits Brakes

SpaceXAI's AI coding assistant, Grok Build, found itself in hot water this week after a security report revealed it was quietly uploading users' entire code repositories to Google Cloud by default. The company has since disabled the feature and promised to scrub the uploaded data.

According to a report from Cereblab, the Grok Build CLI didn't just grab the files you were working on—it packaged up the whole codebase, including files marked as off-limits and even sensitive info that had been deleted from the history. That's a much broader data grab than what similar tools like Claude Code do.

By Monday, researchers noted that SpaceXAI's servers had returned a "disablecodebaseupload: true" flag, meaning the upload behavior had been shut down. So, for now, the leaky faucet is turned off.

Elon Musk took to X to address the uproar, stating that any previously uploaded data would be "completely and thoroughly deleted." He emphasized that SpaceXAI "always respects privacy settings," but also added a caveat: he hopes users will allow the platform to keep data to help identify and fix bugs.

Independent security researcher Lukasz Olejnik from King's College London warned that hoarding this much code is a recipe for disaster. "Such large-scale data retention poses obvious risks," he said, pointing to potential exposure of proprietary source code, security vulnerabilities, personal data, infrastructure details, and access credentials.

Image

Key Points

  • Grok Build uploaded entire codebases to Google Cloud, including sensitive and deleted files.
  • SpaceXAI disabled the feature after the report and promised to delete uploaded data.
  • Elon Musk defended the practice but urged users to allow data retention for debugging.
  • Security experts warn of risks like leaked credentials and proprietary code.