xAI kills Grok CLI's silent codebase upload from the server side — no client patch, no notice, no data revocation
TL;DR
Less than 24 hours after a researcher found Grok Build CLI silently uploads entire codebases and key files, xAI killed it server-side.
Less than 24 hours after Grok Build CLI was caught silently uploading full codebases and key files, xAI added a
The trigger was a Reddit researcher's analysis: on first launch, Grok Build CLI recursively scans the working directory and packages files including
xAI's remediation is blunt: no revocation of already-uploaded data, no public statement, no client update. A server-side flag simply flips off the capability. Any installed CLI silently loses the upload path on next connection — local files stop being read and shipped.
Grok Build CLI shipped to compete with Claude Code and Codex CLI, pitched on "local codebase understanding + xAI large model reasoning." Musk claimed on X last month that the tool serves 120,000 developers. Whether that batch of uploaded code is retained, deleted, or repurposed — xAI has not answered.
via Reddit r/xAI
disable_codebase_upload field on the server, returning true to shut off the upload path. The CLI binary itself received no update — not a single line.The trigger was a Reddit researcher's analysis: on first launch, Grok Build CLI recursively scans the working directory and packages files including
.env, ~/.aws/credentials, and ~/.ssh/id_rsa to send to xAI servers, described as "context optimization." None of that behavior appears in the documentation, CLI prompts, or user agreement.xAI's remediation is blunt: no revocation of already-uploaded data, no public statement, no client update. A server-side flag simply flips off the capability. Any installed CLI silently loses the upload path on next connection — local files stop being read and shipped.
Grok Build CLI shipped to compete with Claude Code and Codex CLI, pitched on "local codebase understanding + xAI large model reasoning." Musk claimed on X last month that the tool serves 120,000 developers. Whether that batch of uploaded code is retained, deleted, or repurposed — xAI has not answered.
via Reddit r/xAI
