SpaceXAI has disabled a feature in its Grok Build AI coding assistant after researchers discovered that the tool was uploading users’ entire code repositories to Google Cloud without clearly informing them. This issue has drawn attention from thousands of users, including the OpenAI CEO Sam Altman, who described the incident as “Concerning” in a post on X.
As per the security researchers, Grok Build CLI was packaging and transferring complete codebases to cloud storage during the development sessions. The researchers even claimed that the uploads included files the AI assistant had been instructed not to access, as well as sensitive information that had previously been removed from version history. They also noted that the amount of data being retained appeared larger than what is typically collected by competing AI coding tools.
After the disclosure, the researchers observed that SpaceXAI updated its servers to send a new configuration flag which disables automatic codebase uploads. Subsequent testing reportedly confirmed that the upload process had stopped.
Also read: Google DeepMind CEO calls for new AI regulator, Sam Altman and Sundar Pichai react
Elon Musk also responded on X, claiming that all previously uploaded data would be completely and utterly deleted. He further maintained that Grok respects users’ privacy settings but encouraged the developers to allow data retention where possible, arguing that it helps in identifying and fixing technical issues.
As per the reports, the cybersecurity experts have pointed out to the extent of information that may have been exposed. Independent security researcher Dr. Lukasz Olejnik said the data collected could potentially include proprietary source code, infrastructure details, credentials, personal information and security-related documentation.
SpaceXAI initially pointed users to the /privacy command within the CLI as a way to disable data retention. However, Cereblab clarified that the command only controls retention for an individual session and was not responsible for stopping the bigger codebase upload feature.