The Information Machine

Grok CLI Privacy Scandal and Apache 2.0 Open Source Release · history

Version 3

2026-07-18 18:08 UTC · 28 items

What

xAI's Grok Build terminal coding agent was found uploading entire user home directories — including SSH keys and password manager databases — to xAI's Google Cloud storage by default [1][3]. The uploads bypassed the tool-call permission system even when tool calls were disabled, and an in-app privacy toggle failed to block them [2]. xAI deleted all retained user data, disabled the upload feature, and released the full codebase (~844,530 lines of Rust) under Apache 2.0 [1][4]. Multiple outlets have since reported that the repository exfiltration code remains present in the published codebase [6][7], a claim xAI has not addressed publicly.

Why it matters

The privacy failure was architectural, not just a misconfigured default: uploads bypassed a permission boundary users would reasonably treat as a control. The open-source release offers transparency but leaves open whether the upload logic is merely disabled or actually removed, and whether ported competitor code complies with upstream licenses.

Open questions

  • Was the upload bypass of the tool-call permission system intentional, a design oversight, or a bug? [2]

  • Multiple sources report the repository exfiltration code remains in the open-sourced codebase [6][7] — has xAI addressed whether this code is functional or inert?

  • The codebase includes tool implementations ported from OpenAI Codex and OpenCode [1] — do those ports comply with upstream license terms?

  • Will xAI introduce governance changes to prevent similar defaults, given the simultaneous removal of quantitative risk thresholds from its Frontier AI Framework? [2]

Narrative

Grok Build, xAI's terminal coding agent, came under scrutiny after users discovered it was uploading entire home directories to xAI's Google Cloud buckets by default. The scope exceeded a misconfigured default: the tool transmitted private Git repositories including secrets preserved in git history, SSH keys, password manager databases, photos, and videos when run from the home directory [1]. Critically, these uploads occurred outside the tool-call permission system that users would reasonably treat as a control boundary — even when tool calls were explicitly disabled [2]. An in-app privacy toggle reportedly failed to block them [3].

xAI responded by deleting all previously retained user data, describing the deletion as precautionary, and disabling the upload feature [1]. The company then released the full Grok Build codebase under Apache 2.0 — approximately 844,530 lines of Rust with roughly 3% vendored code — and reset usage limits for users [1][4][5]. A technical review found tool implementations ported from competing coding agents including OpenAI Codex and OpenCode, and noted that the subagent system prompt instructs the model not to reveal its contents while the main agent prompt carries no such restriction [1].

The open-source release has not closed the question of whether the upload behavior is fully gone. ByteIota and TechTimes both reported that the code enabling repository exfiltration remains present in the published codebase [6][7], and The Decoder framed the overall incident as a "massive data breach" [8]. xAI has not publicly responded to these characterizations. Separately, commentator Zvi Mowshowitz placed the incident within a broader pattern of xAI governance concerns, noting that xAI silently revised its Frontier Artificial Intelligence Framework on June 30, 2026 to remove quantitative risk acceptance thresholds and whistleblower protections, replacing them with undefined qualitative language [2].

Timeline

  • 2026-06-30: xAI silently rewrites its Frontier AI Framework, removing quantitative risk acceptance thresholds and whistleblower protections in favor of qualitative language. [2]
  • 2026-07-14: Users report Grok Build uploading entire home directories — including SSH keys and password manager databases — to xAI's Google Cloud storage by default. [1][3]
  • 2026-07-14: Reports confirm the in-app privacy toggle failed to prevent uploads and that uploads bypassed the tool-call permission system even when tool calls were disabled. [3][2]
  • 2026-07-14: xAI announces deletion of all previously retained user data and disables the upload feature. [1][9]
  • 2026-07-15: xAI releases the full Grok Build codebase under Apache 2.0 (~844,530 lines of Rust); usage limits are reset. [1][4][5][12]
  • 2026-07-15: Simon Willison publishes a technical walkthrough noting ported competitor code and the subagent prompt secrecy asymmetry. [1]
  • 2026-07-16: TechTimes and ByteIota report the repository exfiltration code remains present in the open-sourced codebase. [6][7]
  • 2026-07-16: The Decoder covers the open-source release, framing the underlying incident as a "massive data breach." [8]
  • 2026-07-16: Willison compiles the Grok CLI's built-in Mermaid diagram renderer from Rust to WebAssembly for browser use. [10]
  • 2026-07-16: Zvi Mowshowitz publishes a critical analysis connecting the Grok Build incident to a broader pattern of xAI governance failures, including the June 30 Framework rewrite. [2]

Perspectives

xAI

Acknowledged the privacy issue, deleted all retained user data as a precautionary measure, and open-sourced the codebase under Apache 2.0 with usage limits reset. Has not responded to reports that exfiltration code remains in the published code.

Evolution: Response was reactive to community reports; no subsequent public statements on remaining code claims.

[1][9][5]

Simon Willison

Analytical: reported the privacy incident factually, conducted a technical walkthrough of the codebase noting ported competitor code and the subagent prompt asymmetry, and compiled the Mermaid renderer to WebAssembly.

Evolution: Consistent analytical posture throughout.

[1][10]

Zvi Mowshowitz

Sharply critical: frames the upload behavior as part of a broader pattern of irresponsible xAI practices, citing the silent removal of risk thresholds and whistleblower protections from xAI's Frontier AI Framework.

Evolution: Consistent with his broader posture of skepticism toward AI governance failures.

[2]

Affected users / community

Initially alarmed at the scope of data collected; generally positive about the open-source release.

Evolution: Initial alarm shifted toward interest and approval once the open-source release was announced.

[1][3][11]

Tech press (The Decoder, ByteIota, TechTimes)

Framing ranges from neutral coverage of the open-source release to characterizing the underlying incident as a 'massive data breach' and flagging that upload code remains in the published repository.

Evolution: Coverage has moved from initial alarm to scrutiny of the open-source release's completeness.

[7][8][6]

Tensions

  • xAI framed the data deletion as an adequate precautionary response, but the uploads bypassed the tool-call permission system even when tool calls were disabled — a more severe architectural failure than a misconfigured default. [1][2]
  • xAI open-sourced the codebase as a transparency measure, but ByteIota and TechTimes reported the repository exfiltration code remains present in the released code — leaving unresolved whether the behavior is gone or merely disabled. [1][6][7]
  • The in-app privacy toggle was presented as a user control, but reports indicate it failed to prevent uploads — a gap between advertised controls and actual behavior that xAI has not directly addressed. [3]
  • The codebase includes tool implementations ported from OpenAI Codex and OpenCode, but neither OpenAI nor OpenCode maintainers have commented on whether those ports comply with upstream license terms. [1]
  • The subagent prompt instructs the model to conceal its contents while the main agent prompt carries no such restriction — an asymmetry in transparency that xAI has not explained. [1]

Sources

  1. [1] xai-org/grok-build, now open source — Simon Willison (2026-07-15)
  2. [2] AI #177 Part 1: Tip of the Iceberg — Zvi's AI Roundups (2026-07-16)
  3. [3] Grok Build Shipped Entire Codebases to xAI Cloud — reactive:grok-cli-privacy-open-source
  4. [4] GitHub - xai-org/grok-build: SpaceXAI's coding agent harness and TUI. Fullscreen, mouse interactive, extensible. — reactive:grok-cli-privacy-open-source
  5. [5] Grok Build open-sources code and resets usage limits for ... — reactive:grok-cli-privacy-open-source
  6. [6] Grok Build Open-Sourced After Covert Upload: Code to Exfiltrate Repos ... — reactive:grok-cli-privacy-open-source
  7. [7] Grok Build Is Open Source — But the Upload Code Remains — reactive:grok-cli-privacy-open-source
  8. [8] xAI open-sources "Grok-Build" on GitHub after massive data ... — reactive:grok-cli-privacy-open-source
  9. [9] xAI to Delete All User Data Following Grok Build Code Upload Controversy — reactive:grok-cli-privacy-open-source
  10. [10] Mermaid to Unicode box art (grok-mermaid) — Simon Willison (2026-07-16)
  11. [11] Grok Build open sourced under Apache 2.0 license — reactive:grok-cli-privacy-open-source
  12. [12] xAI Open-Sources Grok Build CLI in Rust, Resets User Limits — reactive:grok-cli-privacy-open-source