xAI open-sources Grok Build after its CLI silently uploaded users' local directories
xAI released Grok Build under Apache 2.0 — 844,530 lines of Rust — after users found the coding-agent CLI silently uploading entire local directories to xAI's Google Cloud buckets, with one report naming SSH keys and a password-manager database. xAI disabled the upload, deleted retained data, and set retention off by default from July 12, and the open harness now lets a developer run Grok Build fully local-first with their own inference and audit the disabled upload code directly.
Source: simonwillison.net ↗
running the command in a directory could upload that entire directory to xAI's Google Cloud buckets
Simon Willison
Why this matters
- → Massive security incident exposed SSH keys and password databases to third parties
- → Open-sourcing 844K lines of code after breach signals trust-rebuilding attempt
- → Establishes local-first, auditable alternative to proprietary coding agents
Privacy through transparency