Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read
Summary
Grok Build, xAI's coding assistant, was uploading entire Git repositories (a version control system that tracks code changes) to cloud storage, not just the files it needed to read. A researcher discovered that a 12 GB repository generated only 192 KB of traffic to the model but 5.10 GB to storage, and even files the AI was instructed not to open were included, along with unredacted credentials like API keys and passwords. Unlike competing tools from Claude and Google, Grok Build was the only one collecting the entire workspace.
Solution / Mitigation
On July 13, xAI disabled the storage uploads server-side by switching a flag (disable_codebase_upload: true and trace_upload_enabled: false), which multiple users confirmed they received. However, xAI has not confirmed whether this change applies to all accounts or is permanent, and no update to the software itself was released—the change was made on the server side while users remained on version 0.2.93.
Classification
Affected Vendors
Related Issues
CVE-2025-45150: Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive
CVE-2025-54868: LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint
Original source: https://thehackernews.com/2026/07/grok-build-uploads-entire-git.html
First tracked: July 14, 2026 at 08:01 AM
Classified by LLM (prompt v3) · confidence: 95%