What xAI's Grok Build CLI Actually Sends to xAI
3 hours ago
- #Security
- #Privacy
- #Data Exfiltration
- Grok Build CLI transmits the contents of files it reads, including secrets in .env files, unredacted to xAI via POST /v1/responses and POST /v1/storage.
- Grok uploads the entire repository, including unread files and git history, to Google Cloud Storage bucket 'grok-code-session-traces' at multi-GB scale, independent of model usage quotas.
- The upload mechanism is active by default, not disabled by the 'Improve the model' toggle, and not explicitly documented in the CLI's setup materials.