Did Grok Just Steal Your Code? The Silent CLI Leak Rocking xAI

If you’ve been testing out the new Grok Build CLI from xAI recently, you might want to sit down and check your .env files.

Over the last few days, a massive security scandal has quietly unfolded in the developer community. Security researchers caught the popular terminal-based AI coding assistant doing something unthinkable: silently uploading entire, unredacted Git repositories to a private Google Cloud Storage bucket.

This wasn’t just a handful of relevant files being sent to an LLM for context. We are talking full commit histories, untouched source code, and plain-text API keys.

Here is exactly what happened, how the exploit worked, and why xAI’s response is making developers furious.

The Shocking Discovery

The issue was first uncovered by a security researcher operating under the pseudonym cereblab. By routing the Grok Build CLI (specifically version 0.2.93) through a network proxy, the researcher intercepted the tool’s HTTPS traffic to see exactly what it was phoning home.

The researcher identified two distinct communication channels:

1. The Expected Channel: The first channel (/v1/responses) behaved normally. It transmitted only the specific files the Grok agent actually opened to complete your coding prompt.
2. The “Shadow” Channel: The second channel (/v1/storage) was a massive red flag. It was packaging up the entire Git repository into a bundle and firing it off to a Google Cloud Storage bucket named grok-code-session-traces.

The scale of the data exfiltration was staggering. In one test using a 12 GB repository, the Grok agent only needed about 192 KB of context to complete its assigned task. Yet, the CLI silently uploaded over 5.1 GB of data in the background.

Even worse, the researcher planted a “canary” .env file containing fake passwords and explicitly told the AI not to read it. The file still got bundled up and sent verbatim to the cloud.

The “Opt-Out” That Did Absolutely Nothing

Perhaps the most frustrating part for privacy-conscious developers is the illusion of consent.

Grok Build includes an “Improve the model” toggle setting designed to stop telemetry and data collection. But cereblab found that even with this privacy setting strictly disabled, the xAI server ignored the preference. It continued to return a trace_upload_enabled: true flag, and the massive gigabyte-scale uploads continued unabated.

The Silent Rollback

How did xAI handle the disclosure of a bug that was essentially siphoning proprietary enterprise code and credentials into their servers? With complete silence.

About a day after the researcher’s findings went viral, users noticed that the uploads suddenly stopped. Behind the scenes, xAI had quietly flipped a server-side flag to disable_codebase_upload: true.

There was no security advisory issued. There was no public statement explaining the logic. Most alarmingly, xAI has not clarified what they intend to do with the data, how long it will be retained, or whether the repositories that have already been uploaded will be permanently deleted.

(Note: While the data was transferred and stored, researchers explicitly point out there is no hard proof yet that xAI actually trained its models on this stolen codebase. But the fact remains: your data left your machine without permission).

What You Need To Do Right Now

If you have used the Grok Build CLI on any proprietary, private, or sensitive repositories prior to this week, you need to assume your codebase has been compromised.

1. Rotate Your Secrets: Any API keys, database passwords, cloud tokens, or SSH keys stored in your .env files or hardcoded into your commit history should be immediately revoked and rotated. Treat them as if they have been posted publicly.
2. Audit Your Tools: This incident is a brutal reminder that giving a terminal-based AI agent full access to your filesystem is functionally equivalent to giving a stranger a backdoor to your machine.

The Verdict

We are living in an era where AI developer tools are incredibly powerful and genuinely speed up engineering workflows. But incidents like this destroy the fragile trust between developers and AI companies. Building an agentic workflow is the future, but it cannot come at the cost of silently exfiltrating our entire hard drives to the cloud.

The age of blindly trusting your CLI is over.