Grok Was Caught Uploading Your Entire Codebase

Englishالعربية Deutsch Español Français हिन्दी Bahasa Indonesia 日本語 한국어 Português Русский 中文

Computing/SoftwareBusiness NewsInternet Technology

Transcript

00:00:00grok has uploaded my entire user directory to xai servers it contains my ssh keys my password

00:00:05manager database my documents photos videos everything grok's coding cli uploaded your

00:00:10whole repo and your git history including files it was told not to open and secrets deleted from

00:00:16history this is a seriously bad and massive mistake from the grok team so let's break down

00:00:20what happened how you can check if your code was uploaded and what xai has done to fix this

00:00:29so i first came across this from this tweet telling people to run this grep command to read

00:00:33that grok logs saying you will be pissed it shows a photo of the log showing it queuing up a repo

00:00:38upload to grok servers this tweet has hundreds of replies and quotes of people running this command

00:00:42and getting a similar result and even one user who ran grok in his home directory reporting they

00:00:47uploaded all of it further investigations show that it ships a malware-like background code collector

00:00:52so let's take a look at what he was actually doing and this is a report by a researcher called cereblab

00:00:56used mitm proxy to inspect the traffic that grok cli was sending and receiving and they open up grok in

00:01:02a repo and the only prompt that they sent to it was reply okay do not open any files it turns out

00:01:07though that that instruction does not matter as grok still uploaded the entire repo anyway there was a

00:01:12post request that was sent containing the whole repo bundle and this bundle had all of the git history

00:01:16and even environment variables this is what i find so bad about all of this yes we all know that when

00:01:21we're using a remote model a code is going to be sent to our servers but there's normally an assumption

00:01:26that it's only the code that actually needs to read that is sent to them it's not the entire code base

00:01:30even when it's not relevant to the prompt they even showed that this worked when a repo was 12 gigabytes

00:01:35it still uploads the whole thing testing this in the other tools like clawed code codex and gemini it

00:01:40shows that it only sends the file that it reads this is a unique problem to grok cli they even found

00:01:45that if you turned off the help improve this model setting it would still do this and fetching the user

00:01:51that there was actually a flag called trace upload enable which was always set to true now all of

00:01:55these tweets and this post started to go viral so how did xai respond well first they made a bit of

00:02:01a silent fix if you tried this again a day later after the post went viral the settings showed that

00:02:05that trace upload flag was now disabled and there was actually a new one called disable codebase upload

00:02:10which was set to true seemingly for everyone's account so they'd actually put in a server side kill

00:02:14switch for the upload of code shortly after they then also publicly responded on twitter saying we care

00:02:19deeply about your privacy and respect customer choice for teams using zero data retention no trace and

00:02:24code data is ever retained all api key use of grok build also respects zero data retention if zero

00:02:30data retention is disabled the slash privacy command is available in the cli to disable data retention

00:02:36which also deletes previously synced data run the slash privacy command to view or change your

00:02:40settings at any time elon also tweeted saying that as a precautionary measure all user data that was

00:02:45uploaded to space xai before now will be completely and utterly deleted zero anything whatsoever will

00:02:51remain but you did also ask in another tweet that you leave the setting on as it's actually helpful

00:02:55for debugging issues if they can retain some amount of data which i can believe that if we were just

00:03:00talking about traces that is a pretty common practice but uploading an entire repo to their servers

00:03:05none of these responses seem to address that part and the new grok cli update simply added a privacy

00:03:10command but it's worth noting that this update didn't actually remove the code that uploads your whole

00:03:14repo you can actually still find that in the binary so it seems the only thing stopping this from turning

00:03:18on again is that server side flag that is controlled by xai it just really seems to me like this code

00:03:23shouldn't be in there as no other tool uses it plus if we take a look at that new privacy command this

00:03:28actually simply disables traces and flips the server side toggle called coding data retention opt-out

00:03:33and the same researcher actually analyzed this command and showed that it does nothing locally your

00:03:38session traces are still posted to xai in full whether it's on or off and the only difference is in

00:03:43how the server responds if it's off it's going to respond with a 200 meaning that it's been stored

00:03:48and if privacy mode is on it simply returns a 204 to say no content and the data has been discarded

00:03:53so it's actually only a server side retention switch and it doesn't block it from the client side so

00:03:58you're still transmitting everything you just have to trust that xai servers are actually going to

00:04:02discard it instead of storing it even if i did trust xai it gets even worse because that privacy command

00:04:07it's actually a per session retention toggle so you may have to toggle this in every session to keep

00:04:12your data safe this just seems incredibly backwards to me but this is where we are now if you have used

00:04:17the groc cli in the past and you want to see what may have leaked from your machine you can check your

00:04:21logs this grep command shows you exactly which sessions triggered the uploads if you take security

00:04:26seriously as well you're probably going to want to rotate all of those keys if it does show that some

00:04:30of this data was sent over unless you trust fully that xai has deleted all of this finally if you want to

00:04:35keep some semblance of privacy while still using the groc cli although i probably wouldn't recommend it

00:04:40there is a really good write-up here on how you can harden the groc cli and it shows you where to

00:04:44set things like disabled codebase upload in your config which should hard stop that upload pipeline so

00:04:49that's the story for some reason groc was uploading your whole repo even when it didn't need it and they

00:04:53seemingly have deleted all of that data now and walked back the feature but i do want to know do you

00:04:58trust them and would you use the groc cli from now on now that you know this let me know in the

00:05:02comments down below wait there subscribe and as always see you in the next one

Key Takeaway

Grok CLI exfiltrated full local codebases and sensitive credentials to xAI servers by default, and current privacy commands fail to stop this transmission at the client level.

Highlights

The Grok CLI automatically uploaded entire user repositories to xAI servers, including git history, environment variables, SSH keys, and password manager databases.
Internal testing confirmed the tool uploaded 12 gigabyte repositories even when specifically instructed not to open any files.
Independent analysis revealed a hardcoded flag, trace_upload_enable, set to true by default, which bypasses user privacy settings.
The /privacy command in the CLI functions only as a server-side filter rather than a local block, meaning data is still transmitted to xAI servers.
xAI responded to public reports by implementing a server-side kill switch and publicly committing to delete all previously uploaded user data.

Timeline

Grok CLI Data Collection Findings

The Grok CLI transmits entire user directories and git histories regardless of specific prompts.
Sensitive information including SSH keys, environment variables, and password databases are included in these uploads.
Unlike similar tools such as Claude Code or Gemini, the Grok CLI does not limit data transmission to relevant files.

Security researchers identified that the Grok CLI functions as a background code collector, sending large volumes of local data to xAI servers. Traffic inspection tools demonstrated that even when prompted to ignore files, the CLI bundles the entire repository for transmission. This behavior persists even when users explicitly disable features intended to help improve the model.

xAI Response and Mitigation

xAI introduced a server-side kill switch called disable_codebase_upload after the issue gained public attention.
Elon Musk publicly stated that all previously uploaded user data would be deleted from xAI servers.
The newly added /privacy command serves only as a server-side instruction to discard data rather than a local block on transmission.

Following reports of the leak, xAI modified server-side configurations to stop further repository uploads. While the company claims to have deleted all retained data, the underlying code for the collection remains present within the CLI binary. The privacy command introduced to address concerns simply changes a server response from a 200 (stored) to a 204 (discarded), while the client-side transmission continues.

Security Implications and Recommendations

The /privacy command requires manual activation for every new session to prevent data retention.
Users should consider rotating all credentials and keys that existed in the local environment during Grok CLI usage.
Hardening the CLI requires manually setting configuration flags like disable_codebase_upload to stop the pipeline locally.

Because the privacy settings act only on a per-session basis, the risk of transmission remains unless users manually configure their environment. If the logs indicate that data was sent, rotating keys is necessary to ensure security. Manually modifying the configuration file to enforce a permanent stop to the upload pipeline is the only definitive method to prevent future data leakage.

Community Posts

Write about this video