xAI’s Coding Agent Was Quietly Uploading Entire Repositories — Including SSH Keys

xAI’s Coding Agent Was Quietly Uploading Entire Repositories — Including SSH Keys

Of all the software news to break in July 2026, few stories have rattled the developer community quite like the discovery that xAI’s Grok Build, a terminal-based AI coding agent, had been silently uploading developers’ entire codebases — full Git history, committed secrets, SSH keys, and in some cases entire home directories — to a Google Cloud Storage bucket controlled by xAI. The findings, published by an independent security researcher operating under the handle Cereblab, triggered a fast-moving sequence of denials, fixes, public promises, and ultimately a full open-source release of the tool’s code — with the upload capability still technically present, just switched off.

⚠️ Quick Take: A privacy toggle that developers believed prevented codebase transmission had no actual effect on uploads, and the volume of data sent was roughly 27,800 times greater than what the coding task itself required.

How the Discovery Happened

Cereblab’s approach was methodical: using the network interception tool mitmproxy, the researcher captured traffic generated by Grok Build CLI version 0.2.93 while running a deliberately simple, benign task. In one test, the researcher instructed the agent to reply with a single word and explicitly told it not to open any files. Grok Build uploaded the entire repository anyway, along with its full Git history — including secrets that had been committed and later deleted months earlier. The researcher reproduced the same result on a separate, unrelated repository, ruling out a one-off fluke.

To make the “unread file” claim unambiguous, testing later confirmed a planted file named with a unique marker — one the agent was never instructed to open — was recovered intact from the uploaded Git bundle, alongside the repository’s complete commit history. The destination was a storage bucket named grok-code-session-traces, identifiable directly in the tool’s binary and in accompanying metadata files pointing to the exact storage path being used.

📊 The Numbers That Made This Serious

• Upload volume: Roughly 27,800 times greater than the data actually required to complete the coding task being tested.
• Test repository size: A 12GB test repository generated only about 192KB of traffic for the coding task itself — with a much larger, separate, undocumented storage transfer happening alongside it.
• Upload mechanics: Data moved in chunks of roughly 75MB each, with every chunk returning a successful HTTP status, and total volume scaling directly with overall repository size across the researcher’s tests.
• Privacy toggle effect: None. The uploads occurred regardless of whether the “Improve the model” privacy setting was enabled or disabled, directly contradicting xAI’s own prior marketing language about nothing being transmitted from a codebase during a session.
• Affected data types: Full Git commit history, committed-and-later-deleted secrets, API keys, and — in at least one separately reported case — an entire user directory including SSH keys and password manager databases.

xAI’s Response: Fast, But Incomplete

xAI moved quickly once the report went public. The company disabled the upload behavior server-side on July 13, the day after Cereblab’s initial wire-level analysis was published, though it did so without issuing a formal security advisory or a changelog entry explaining what had changed. Elon Musk personally posted that all previously uploaded user data would be deleted entirely, but the company did not publicly disclose how many users were affected, how long the data had already been sitting in storage before the fix, or provide any mechanism for individual developers to independently verify that their own uploaded data had actually been purged.

Two days after the server-side fix, on July 15, xAI open-sourced Grok Build’s full codebase under an Apache 2.0 license — a substantial release exceeding 800,000 lines of Rust, covering the agent loop, file-editing and shell-execution tools, the terminal interface, and an extension system supporting skills, plugins, hooks, and MCP servers. On the surface, that looked like a strong transparency gesture in the wake of the incident. But developers who examined the newly published source code found something that undercut the reassurance: the exact code responsible for the earlier uploads, including the file handling the Google Cloud Storage write operation, remained present in the published binary. It is currently held inactive only by a server-side configuration flag — one that xAI could technically re-enable at any time without requiring users to install any new software update.

What Every Grok Build User Should Do Now

• Treat every credential as potentially exposed. Security researchers are advising that any developer who ran Grok Build before July 13, 2026 inside a directory containing a Git repository should assume every tracked credential — including ones committed and later removed from working files months prior — may have been transmitted to xAI’s servers.
• Rotate affected secrets. API keys, database passwords, cloud access tokens, and SSH keys that existed anywhere in an affected repository’s tracked files or Git history should be rotated as a precaution, regardless of Musk’s public deletion promise.
• Don’t rely on the privacy toggle alone. Because the “Improve the model” setting had no measurable effect on the upload behavior during testing, developers should not assume any privacy setting fully controls data transmission without independent verification.
• Audit any tool with broad filesystem access. Grok Build, like many AI coding agents, ran with the same permissions as the user’s own account, meaning it could read sensitive directories like SSH key stores, cloud credential files, and password manager databases if it chose to.

Why This Incident Matters Beyond Grok Build Specifically

The Grok Build episode is a sharp illustration of a structural risk that applies to the entire category of AI coding agents, not just this one product. Modern coding agents are routinely granted the same filesystem access as the developer running them — which means they can, technically, read anything the developer’s own account can read. Most of the time, that access is used narrowly and appropriately to complete the coding task at hand. The Grok Build case demonstrates what happens when that access is used far more aggressively than users were led to believe, and when the mismatch between marketed behavior and actual behavior only comes to light through independent, wire-level security research rather than vendor disclosure.

Security researchers who have been tracking the broader AI coding agent landscape describe this as part of a recognizable pattern: as these tools gain deeper access to development environments in pursuit of more autonomous, capable behavior, the attack surface expands in ways that traditional security review processes weren’t originally built to catch. A tool that can read and act on an entire codebase without explicit per-file consent is, by design, one credential leak or one misconfigured storage bucket away from an incident exactly like this one.

Frequently Asked Questions

Is Grok Build still uploading repositories? According to follow-up testing, the uploads stopped after xAI implemented a server-side change on July 13, 2026, though this has only been independently verified on a limited number of machines and accounts.

Is the vulnerable code still in the software? Yes — security researchers examining the open-sourced release confirmed the upload-capable code remains present in the published binary, currently disabled only by a remotely controlled configuration flag rather than removed from the codebase entirely.

Has xAI confirmed how many users were affected? No. As of this writing, xAI has not publicly disclosed the scope of affected users, the duration data sat in storage, or provided a way for individual developers to confirm their own data was deleted.

Does open-sourcing Grok Build fix the underlying trust issue? Not entirely. While open-sourcing increases code transparency and lets the community audit the tool directly, the persistence of dormant upload code gated only by a server-side flag means the behavior could theoretically return without a new software release, which limits how much reassurance the open-source move alone provides.

Homizel recommends any team currently using Grok Build review their credential rotation policies immediately and monitor xAI’s channels for any further disclosure regarding the scope of this incident.

How This Compares to Other AI Coding Agent Incidents in 2026

The Grok Build episode didn’t happen in isolation — 2026 has already seen a steady drumbeat of security concerns tied to AI coding agents gaining broader autonomy and deeper filesystem access. Industry security trackers following the category closely have described a clear pattern emerging across multiple incidents this year: as agentic coding tools are given more permission to read, modify, and act across an entire codebase autonomously, the potential blast radius of a single misconfiguration or undisclosed behavior grows correspondingly larger. What made the Grok Build case stand out specifically was the scale of the mismatch between marketed behavior and actual behavior — a company explicitly telling developers nothing was transmitted from their codebase during a session, while wire-level analysis proved the opposite in a reproducible, testable way.

That combination — an explicit privacy claim, a toggle that appeared to control it but didn’t, and a volume of unauthorized data transfer nearly five orders of magnitude larger than what the task required — is what elevated this from a minor disclosure footnote into one of the most discussed software security stories of the month. For engineering leaders evaluating any AI coding agent going forward, the practical lesson isn’t necessarily to avoid agentic tools altogether, but to treat vendor privacy claims as something to verify independently wherever possible, rather than accept at face value simply because a settings toggle exists with a reassuring label attached to it.

Broader Industry Reaction

The incident prompted a wave of commentary from security researchers and engineering leaders across the industry, many of whom used it as a case study for why organizations need explicit AI usage policies covering which coding tools are approved, what categories of data are off-limits from being processed by third-party AI infrastructure, and who within an organization is responsible for vetting new agentic tools before they’re adopted team-wide. The core challenge many pointed to isn’t unique to xAI: a large share of AI-enabled developer tools don’t clearly disclose which third-party infrastructure providers process user data behind the scenes, making it difficult for security teams to perform meaningful due diligence before rollout, even when they want to.