SpaceXAI's Grok Build uploaded users' full codebases to cloud

SpaceXAI's Grok Build became the subject of scrutiny when Cereblab, a research group, conducted testing and found the coding tool was engaging in far more aggressive data collection than users likely expected or consented to. The tool was not simply syncing limited session data or anonymized telemetry; it was capturing entire codebases—the complete set of source files a developer works on—and transmitting them to Google Cloud storage. Notably, this behavior persisted even for files developers explicitly instructed the tool not to access, and even for secrets that had been deleted from version history, suggesting the tool was capturing data at a low level of the file system without respecting user intent or best practices around credential handling.

The incident highlights a gap between SpaceXAI's stated privacy posture and its actual behavior. When initially confronted, the company pointed to a /privacy command as the mechanism for disabling data retention. However, Cereblab's analysis revealed that /privacy only toggles per-session retention—it does not control the codebase upload feature that had been activated by default. This discrepancy suggests either poor design or misleading communication about where users could actually control their data. Dr. Lukasz Olejnik's assessment that the retention was "excessive" carries weight given his role as an independent security researcher, and his catalog of potential exposures—from proprietary source code to infrastructure details—underscores the business and operational risk posed by this behavior.