The Information Machine

Grok CLI Privacy Scandal and Apache 2.0 Open Source Release · history

Version 2

2026-07-17 08:08 UTC · 21 items

What

xAI's Grok Build terminal coding agent was found to be uploading entire user home directories and private Git repositories—including SSH keys, password manager databases, and secrets preserved in git history—to xAI's Google Cloud storage by default [2][1]. Critically, the uploads occurred outside the tool-call permission system, even when tool calls were disabled [1], and an in-app privacy toggle failed to block them [3]. xAI deleted all retained user data, disabled the upload feature, and released the full codebase (~844,530 lines of Rust) under Apache 2.0 [2][4]. The open-source release drew additional scrutiny: a TechTimes report claimed the repository exfiltration code remains present in the published codebase [6], and commentators connected the incident to broader xAI governance concerns.

Why it matters

The incident is notable not just as a privacy failure but as an architectural one: uploads bypassed the permission boundary that users would reasonably treat as a control. The open-source release offers transparency into the tool's construction, but leaves unresolved whether the upload logic remains active in the published code and whether ported competitor code complies with upstream licenses.

Open questions

  • The uploads bypassed the tool-call permission system even when tool calls were disabled [1] — was this bypass intentional, a design oversight, or a bug?

  • TechTimes reported the repository exfiltration code remains in the open-sourced codebase [6] — has xAI addressed whether functional upload logic still exists in the published code?

  • The codebase includes tool implementations ported from OpenAI Codex and OpenCode [2] — do those ports comply with upstream licenses?

  • Will xAI introduce governance changes to prevent similar defaults in future releases, given the simultaneous removal of quantitative risk thresholds from its Frontier AI Framework [1]?

Narrative

Grok Build, xAI's terminal coding agent, came under scrutiny after users discovered it was uploading entire home directories to xAI's Google Cloud buckets by default. The scope was broader than a misconfigured default: the tool transmitted entire private Git repositories including secrets preserved in git history, and did so outside the tool-call permission system that users would reasonably treat as a control boundary, even when tool calls were disabled [1]. At least one user reported the tool transmitted SSH keys, password manager databases, photos, and videos when run from the home directory [2]. An in-app privacy toggle reportedly failed to block uploads [3].

xAI responded by deleting all previously retained user data, describing the deletion as a precautionary measure, and disabling the upload feature [2]. The company then released the full Grok Build codebase under Apache 2.0 — approximately 844,530 lines of Rust with roughly 3% vendored code — and reset usage limits for users [2][4][5]. A technical review found tool implementations ported from competing coding agents including OpenAI Codex and OpenCode, and noted that the subagent system prompt instructs the model not to reveal its contents while the main agent prompt carries no such restriction [2].

Following the open-source release, TechTimes reported that the code enabling repository exfiltration remains present in the published codebase [6], a claim xAI has not publicly addressed. Separately, commentator Zvi Mowshowitz placed the incident within a broader pattern of xAI governance concerns: he noted that xAI silently revised its Frontier Artificial Intelligence Framework on June 30, 2026 to remove quantitative risk acceptance thresholds and whistleblower protections, replacing them with undefined qualitative language [1]. Mowshowitz argued the accumulation of such decisions should affect user trust in xAI products broadly.

Timeline

  • 2026-06-30: xAI silently rewrites its Frontier AI Framework, removing quantitative risk acceptance thresholds and whistleblower protections in favor of qualitative language. [1]
  • 2026-07-14: Users report Grok Build uploading entire home directories—including SSH keys and password manager databases—to xAI's Google Cloud storage by default. [2][3]
  • 2026-07-14: Reports indicate the in-app privacy toggle failed to prevent uploads, and uploads bypassed the tool-call permission system even when tool calls were disabled. [3][1]
  • 2026-07-14: xAI announces deletion of all previously retained user data and disables the upload feature. [2][7]
  • 2026-07-15: xAI releases the full Grok Build codebase under Apache 2.0 (~844,530 lines of Rust); usage limits are reset. [2][4][5]
  • 2026-07-15: Simon Willison publishes a technical walkthrough noting ported competitor code and the subagent prompt secrecy asymmetry. [2]
  • 2026-07-16: TechTimes reports the repository exfiltration code remains present in the open-sourced codebase. [6]
  • 2026-07-16: Willison compiles the Grok CLI's built-in Mermaid diagram renderer from Rust to WebAssembly for browser use. [8]
  • 2026-07-16: Zvi Mowshowitz publishes a critical analysis connecting the Grok Build incident to a broader pattern of xAI governance failures, including the June 30 Framework rewrite. [1]

Perspectives

xAI

Acknowledged the privacy issue, deleted all retained user data as a precautionary measure, and open-sourced the codebase under Apache 2.0 with usage limits reset. Has not responded to the claim that exfiltration code remains in the published code.

Evolution: No prior public stance documented; response was reactive to community reports.

[2][7][5]

Simon Willison

Analytical: reported the privacy incident factually and conducted a technical walkthrough of the codebase, noting ported competitor code and the subagent prompt asymmetry without taking an advocacy position.

Evolution: Consistent analytical posture throughout.

[2][8]

Zvi Mowshowitz

Sharply critical: frames the upload behavior as part of a pattern of irresponsible xAI practices, citing also the silent removal of risk thresholds and whistleblower protections from xAI's Frontier AI Framework.

Evolution: New voice in this thread; consistent with his broader posture of skepticism toward AI governance failures.

[1]

Affected users / community

Initially alarmed at the scope of data collected; generally positive about the open-source release.

Evolution: Initial alarm shifted toward interest and approval once the open-source release was announced.

[2][3][9]

Tensions

  • xAI framed the data deletion as an adequate precautionary response, but the uploads bypassed the tool-call permission system even when tool calls were disabled — a more severe architectural failure than a misconfigured default. [2][1]
  • xAI open-sourced the codebase as a transparency measure, but TechTimes reported the repository exfiltration code remains present in the released code — leaving unresolved whether the behavior is actually gone or merely disabled. [2][6]
  • The in-app privacy toggle was presented as a user control, but reports indicate it failed to prevent uploads — a gap between advertised controls and actual behavior that xAI has not directly addressed. [3]
  • The codebase includes tool implementations ported from OpenAI Codex and OpenCode, but neither OpenAI nor OpenCode maintainers have commented on whether those ports comply with upstream license terms. [2]
  • The subagent prompt instructs the model to conceal its contents while the main agent prompt carries no such restriction — an asymmetry in transparency that xAI has not explained. [2]

Sources

  1. [1] AI #177 Part 1: Tip of the Iceberg — Zvi's AI Roundups (2026-07-16)
  2. [2] xai-org/grok-build, now open source — Simon Willison (2026-07-15)
  3. [3] Grok Build Shipped Entire Codebases to xAI Cloud — reactive:grok-cli-privacy-open-source
  4. [4] GitHub - xai-org/grok-build: SpaceXAI's coding agent harness and TUI. Fullscreen, mouse interactive, extensible. — reactive:grok-cli-privacy-open-source
  5. [5] Grok Build open-sources code and resets usage limits for ... — reactive:grok-cli-privacy-open-source
  6. [6] Grok Build Open-Sourced After Covert Upload: Code to Exfiltrate Repos ... — reactive:grok-cli-privacy-open-source
  7. [7] xAI to Delete All User Data Following Grok Build Code Upload Controversy — reactive:grok-cli-privacy-open-source
  8. [8] Mermaid to Unicode box art (grok-mermaid) — Simon Willison (2026-07-16)
  9. [9] Grok Build open sourced under Apache 2.0 license — reactive:grok-cli-privacy-open-source