🛡️ Defense

27,800×: Your AI Coding Assistant Uploaded 5.1 GiB of Your Repository When It Needed 192 KB. The Privacy Toggle Did Nothing.

Wire-level analysis of xAI's Grok Build CLI reveals wholesale codebase exfiltration, including deleted secrets still living in git history, that no user-facing privacy control could stop. Claude Code and Codex sent no repository bundle. A cross-tool data hygiene audit produces results every developer should read.

By Kai Nakamura · Defense & Cyber Capabilities · July 22, 2026

On July 12, 2026, xAI's Grok Build coding CLI uploaded 5.1 gigabytes of data from a single 12 GB test repository to a Google Cloud Storage bucket, while the model-turn traffic (the data the AI actually consumed to answer the developer's question) amounted to 192 kilobytes. A security researcher publishing as cereblab captured the transmission through a local proxy, cloned the intercepted git bundle, and recovered a file the agent had been explicitly instructed not to read, which means the tool was collecting code it never processed and shipping it to infrastructure the developer never approved. The upload traveled in 73 chunks of roughly 75 MB each, every one returning HTTP 200, to a bucket named grok-code-session-traces hard-coded in the binary. The ratio between what the model consumed and what left the machine: 27,800 to one.

Every cloud-based coding assistant sends some source code to a remote model, and that is the fundamental trade-off a developer accepts when they trade privacy for intelligent debugging assistance. The question that matters, and the one this incident answered with uncomfortable precision, is how much code leaves, which files are included, and whether the developer retains any meaningful control over the boundary between helpful and invasive.

What the Wire Showed

Cereblab's methodology was straightforward: route Grok Build's traffic through an intercepting proxy, capture every request, then dissect what went where. Two channels carried data off the machine. The first, POST /v1/responses, sent the files the agent read during its coding task, which is the expected channel that every developer implicitly consents to when they install a cloud coding tool. The second channel, POST /v1/storage, packaged the entire tracked Git repository and its full commit history into a bundle and transmitted it independently of any model interaction, meaning that the collection ran whether or not the agent touched the files in question.

What separates these channels matters for a reason most developers have never had to think about. Git history is not the current working tree. A repository's commit history contains every version of every file that was ever tracked, and that archive inevitably includes credentials, API keys, database passwords, internal URLs, and proprietary configurations that a developer committed once, recognized as a mistake, and removed from the working directory, yet the deletion only cleaned the visible surface, leaving the history intact and the secrets embedded in a data structure that Grok Build bundled whole.

Cereblab planted a canary to test this boundary. A file called src/_probe/never_read_canary.txt sat in the repository with a unique marker, and the agent was instructed: "Reply with exactly: OK. Do not read or open any files." The agent complied with the instruction: it did not read the canary for its coding task. The storage channel bundled and transmitted it anyway, because the upload mechanism operated on a completely independent code path from the model interaction that the developer thought they were controlling. The Hacker News confirmed the same behavior replicated on a second, unrelated repository.

Planted API keys and database passwords in a tracked .env file went through both channels unredacted: first in the model turn when the agent read the file, then again in the session-state archive bound for the storage bucket, doubling the exposure surface for credentials that most developers assume disappear the moment they add .env to their .gitignore.

The Toggle That Toggled Nothing

Most developers would reach for the "Improve the model" setting, a toggle available in Grok Build's preferences that implies comprehensive control over your data's fate. Cereblab turned it off, then watched the uploads continue uninterrupted as the server's own /v1/settings response kept returning trace_upload_enabled: true.

The explanation is structural rather than conspiratorial, and it reveals a design pattern that extends far beyond xAI. The "Improve the model" toggle governs whether xAI trains on your data, which is a question about what happens to code after it arrives at xAI's infrastructure. It does not govern whether your data leaves the machine in the first place, which is an entirely separate question about what happens before xAI's infrastructure is involved at all. Two controls, two boundaries, one toggle. The toggle users saw addressed the question they cared about less; the question they cared about more had no user-facing switch until the disclosure forced xAI to build one.

This gap is precisely what the Moltbook AI agent community identified in parallel. An agent called diviner wrote on July 20: "When a tool is designed to be helpful, it is designed to be dangerous. Feature velocity is currently outrunning permission boundaries." Diviner's post addressed AI tools in general, without referencing the Grok Build incident specifically, which makes the convergence between the observation and the case study all the more instructive, because the pattern is structural enough that unrelated researchers keep stumbling into the same conclusion from different starting points.

The Cross-Tool Audit

Cereblab did not test Grok Build in isolation. The same wire-capture methodology was applied to competing AI coding assistants, producing the first independent, side-by-side comparison of what actually leaves a developer's machine across the major cloud coding tools:

*Gemini's realistic-task test was quota-blocked before completion; the idle test showed no bundle.

The contrast is stark enough to serve as a purchasing criterion. Claude Code and Codex transmitted exactly the files the model needed for the task at hand, which is the expected and defensible behavior of any cloud coding tool that sends code to a remote model. Grok Build transmitted those same files plus everything else in the repository that had ever been tracked by Git, including files the agent never read, files it was explicitly told not to read, and the full commit history containing every secret any developer had ever accidentally committed and subsequently tried to erase.

The Blast Radius Math Nobody Ran

xAI has not disclosed how many developers used Grok Build CLI before the July 13 server-side fix, how long the upload behavior was active across different account types, or how many repositories were captured and stored in the grok-code-session-traces bucket. The absence of disclosure does not prevent a rough estimate of the blast radius.

GitGuardian's 2024 State of Secrets Sprawl report found 12.8 million new secrets exposed in public GitHub repositories in 2023 alone, representing a 28% year-over-year increase that shows no sign of decelerating. The median enterprise repository contains 5.6 secrets embedded in its commit history, credentials that do not appear in the current working tree, cannot be caught by .gitignore, and persist silently in the Git object database until someone runs a dedicated scanning tool or, in Grok Build's case, until an AI coding assistant bundles the entire history and ships it to the cloud.

The multiplication is uncomfortable. If 10,000 developers used Grok Build CLI on repositories with a median of 5.6 historical secrets each, the storage bucket potentially captured 56,000 credentials, including API keys, database passwords, cloud tokens, SSH keys, and webhook secrets, that their owners had already attempted to rotate out of existence by deleting the offending files from the working tree, never suspecting that the Git history would one day be bundled wholesale by a tool they installed to help them write better code.

xAI's response was mechanically swift and structurally revealing. On July 13, one day after cereblab's publication, the same 0.2.93 binary stopped making storage requests without requiring any client update. The server returned disable_codebase_upload: true, proving the upload behavior was controlled by a server-side flag the entire time, which means xAI always had a remote kill switch for a feature that no user could disable locally. An analysis of build 0.2.99 confirmed the upload code remains present in the binary, currently suppressed by the server flag but architecturally capable of reactivation without a client-side update.

The Structural Problem

The Grok Build incident is not an outlier in the sense that one company made a mistake. It is an outlier in degree, not in kind. Every AI coding assistant that sends your files to a remote model operates on an implicit trust bargain: you share source code, it provides intelligent assistance. The precise terms of that bargain, including exactly which files leave your machine, where they go, how long they persist, and whether you can actually stop the flow, are rarely stated clearly and almost never verified independently.

A developer running git log --all --diff-filter=D -- '*.env' '*.pem' '*.key' on any non-trivial repository will likely find deleted credential files still living in the commit history. Those files are invisible in the working directory, absent from ls output, excluded by .gitignore, yet they traveled in their entirety to xAI's cloud storage for every Grok Build user who ran the tool before July 13.

Palo Alto Networks Unit 42 scanned all 49,943 skills on the OpenClaw AI agent registry in early 2026 and found 80 percent showed at least one mismatch between their declared and actual behavior. Five percent, or 2,490 skills, carried multi-stage attack chains. Eighty-eight percent of those chains followed just two patterns: silent credential exfiltration and instruction-override hijacking. The agent skill ecosystem, Unit 42 concluded, has reached the same inflection point that mobile app stores passed a decade ago: openness is outpacing the audit infrastructure that should gate it.

Grok Build's data collection was not a supply chain attack. It was a first-party feature. That distinction matters less than you might think, because the outcome (your credentials in someone else's cloud storage) is identical.

Limitations

Cereblab's captures prove transmission, acceptance, and storage. They do not prove that xAI trained on the uploaded code, that employees read it, or that gitignored files that were never committed were swept into the bundle. The tests used controlled repositories with planted canary credentials, not real-world codebases. The blast-radius estimate above uses GitGuardian's median of 5.6 secrets per enterprise repository; actual exposure depends on the real user count and repository characteristics, neither of which xAI has disclosed. Gemini's realistic-task test was quota-blocked before completion, leaving its full behavior unconfirmed.

The Bottom Line

If you ran Grok Build CLI before July 13, 2026, on any repository containing secrets in tracked files or in Git history, including API keys, database passwords, cloud tokens, and SSH keys that were committed and later deleted, treat those credentials as potentially transmitted. Rotate them now. Deleting the local file does not remove it from the Git history that traveled with the bundle.

For everyone else, the lesson is operational. Run git log --all --diff-filter=D -- '*.env' '*.pem' '*.key' '*.p12' on your repositories before feeding them to any cloud coding tool. Use TruffleHog or Gitleaks to scan your commit history for exposed secrets. Ask yourself what the privacy toggle in your tool of choice actually controls, and then verify the answer with a proxy capture, because "Improve the model" and "send my code to the cloud" turned out to be two different questions with two different answers, and only one was asked.

This article was inspired by observations from the Moltbook AI agent community, where agent diviner identified the permission gap as an emerging exploit primitive.