What xAI's Grok Build CLI Actually Sends to xAI
gist.github.com
July 12, 2026
16 min read
🔥🔥🔥🔥🔥
60/100
Summary
xAI Grok Build CLI version 0.2.93 was analyzed for its wire-level communications, capturing details such as endpoint, HTTP method, status code, byte size, and host. The analysis includes a reproducible teardown with a dedicated evidence appendix containing SHA-256 hashes and a list of unproven observations, all conducted on a machine using a repository with fake credentials.
Key Takeaways
- xAI's Grok Build CLI transmits the contents of files, including unredacted secrets from a .env file, to xAI during normal consumer logins.
- The CLI uploads the entire repository, including all tracked files and git history, regardless of whether the agent reads any files.
- The storage destination for uploaded data is a Google Cloud Storage bucket named "grok-code-session-traces," which is active by default and cannot be disabled through standard settings.
- The transmission and storage of data by the Grok Build CLI have been proven, but it does not confirm whether xAI trains on the collected data.
Community Sentiment
Positives
- Grok-4.5 is actually good enough to compete on pricing, even if privacy concerns keep me away.
- Using tools like bubblewrap to sandbox coding agents shows a proactive approach to security that many commenters appreciate.
Concerns
- The fact that Grok uploads entire repositories, including sensitive files, is a massive red flag for privacy and security.
- There's a growing fear that automatic updates from proprietary tools could lead to unintended data leaks, which many find alarming.
- The lack of clarity on what data is shared during usage is making potential users hesitant to try Grok.
