xAI's Grok CLI Secretly Uploads Your Entire Codebase and Secrets

What xAI's Grok Build CLI Actually Sends to xAI

I conducted a wire-level analysis of the Grok Build CLI and discovered it transmits file contents, including unredacted .env secrets, directly to xAI. Furthermore, the tool uploads your entire repository, including git history, to a Google Cloud Storage bucket regardless of what files the AI agent actually reads. This data transmission happens by default and persists even when you disable the 'Improve the model' setting.

"None of this proves xAI trains on the data — that is a policy question addressed in §6. What is proven is transmission, acceptance, and storage."