Grok's Coding Assistant Was Quietly Shipping Whole Git Repos to xAI

Key points

• A researcher publishing as cereblab found that xAI's Grok Build coding assistant, version 0.2.93, was uploading whole Git repositories to a Google Cloud Storage bucket owned by xAI.
• Uploads included the full commit history, not just the files the assistant needed for a task.
• Cereblab intercepted one upload and retrieved a file the assistant had been told in plain language not to touch.
• The behaviour was spotted in Grok Build's command-line tool, the version developers install on their own machines.
• XAI had not published a security advisory at time of writing.

When a developer used xAI's Grok Build coding tool, it wasn't just reading the files it needed. It was quietly packaging the entire project, every past change included, and sending that package to a storage bucket, a kind of online filing cabinet, controlled by xAI. That's a much bigger scoop of data than any coding task requires.

Cereblab first reported the finding, and The Hacker News covered it. Version 0.2.93 of the command-line interface, the CLI developers install and run in a terminal on their own machines, was the version under test.

What actually got uploaded?

The whole repository. In developer terms, a Git repository is the folder that holds your code plus a hidden record of every edit anyone has ever made to it. That record, called the commit history, often contains things people forgot were there: old passwords, private keys, half-finished features, files deleted months ago but still sitting in the archive.

Grok Build bundled all of it and sent it to a Google Cloud Storage bucket controlled by xAI. Not the two files the assistant needed. Everything.

How do we know it was really happening?

Cereblab caught one upload mid-flight. They intercepted the network request, extracted what's called a Git bundle, essentially a compressed copy of the entire repository, and unpacked it.

Inside was a file the assistant had been explicitly told to leave alone. The plain-English instruction made no difference. The file went to xAI's bucket regardless.

That's the part that stings. Telling an AI coding assistant "do not read this file" isn't a security control. It's a suggestion. If the tool's upload logic runs before or around those instructions, the file gets shipped anyway.

Should developers be worried?

Yes, if they ran Grok Build 0.2.93 on any codebase they consider sensitive. Work repositories, client projects, anything with credentials buried in old commits.

Check whether Grok Build is installed and which version it is. Assume any repository you pointed it at has been copied to xAI infrastructure, history included. Rotate any secrets, passwords or API keys, that ever lived in those repositories, even in long-deleted files.

We've been covering the broader risk of agentic coding tools since our 29 June report on Claude Code being manipulated into opening a reverse shell. This finding is a different kind of problem: not an attacker hijacking the agent, but the tool itself collecting far more than the user expected.

This isn't a novel AI attack. It's a classic data-exfiltration pattern wearing an AI jacket: a client tool sending far more than the user thinks it's sending. The same shape turned up in browser extensions, in mobile SDKs, across a decade of "helpful" developer tooling. The lesson learned the hard way about free IDE plugins now applies to AI coding agents.

Read the network traffic. Trust nothing that phones home by default.