Hacker News
Wire Analysis: xAI's Grok Build CLI Silently Uploaded Entire Repos to a Google Cloud Bucket
Researcher 'cereblab' used mitmproxy on Grok Build CLI v0.2.93 and found it bundling the full tracked repo including Git history — ~5.1GB across 73 chunks on a 12GB test repo — to a GCS bucket named grok-code-session-traces, versus only ~192KB of actual model traffic. The upload included a file the agent was explicitly told not to read, and the 'Improve the model' toggle did not stop it (server still returned trace_upload_enabled:true). xAI added a hidden disable_codebase_upload flag ~a day later with no advisory; v0.2.98 changelog (July 12) never mentions it.
↳ Follow the thread