xAI Grok Build CLI uploads whole repo despite privacy toggle

xAI's Grok Build CLI version 0.2.93 uploaded a full-repository git bundle of roughly 5.10 GiB (5,476,228,005 bytes) to a cloud bucket, even though the user-visible privacy toggle was set to block data collection [Dev.to][cereblab]. The client opens two independent network channels per session. The first channel carries the model-turn data – 196,705 bytes across five requests – which is the code the model actually needs to answer the prompt. The second channel streams a git bundle containing every tracked file and the complete commit history of the repository. In a single instrumented run on a 12 GB test repo, the upload consisted of 73 chunks of ~75 MiB each, amounting to a data-transfer ratio of about 27,800 × more than the model channel [cereblab].

The privacy toggle, advertised as “don’t train on my code,” only governed the first channel. The upload path was hard-coded to a separate endpoint and reported as enabled regardless of the toggle setting. On July 13, 2026, xAI disabled the upload with a server-side flag, but the binary retained the upload code and no client update was released [The Register]. Elon Musk pledged to delete any already-collected data, a promise that remains unverified.

The client was open-sourced under Apache 2.0 on July 16, 2026, allowing anyone to inspect the upload logic [Dev.to]. A community fork quickly stripped the telemetry, demonstrating that the behavior can be removed without vendor cooperation.

The upload poses significant risks, including the exposure of sensitive information. A credential committed eight months earlier remains in the git history and is shipped unchanged [cereblab]. Organizations that treat history as archival are suddenly forced to treat it as live secret material. Furthermore, vendor-side switches are a single point of failure, as the upload can be re-enabled remotely [The Register].