AnalysisCybersecurityJuly 12, 2026
xAI's Grok Build CLI uploads entire repos with secrets to Google Cloud

A teardown of Grok Build CLI (v0.2.93) reveals it transmits all repository files, including .env secrets, to xAI's Google Cloud Storage bucket grok-code-session-traces. Even with a prompt to not read files, the entire repo is uploaded as a git bundle, independent of what the agent reads.
3 sources
xAI's Grok Build CLI Uploads Git Repositories to a Google Cloud Bucketinternationalcyberdigest.com
What xAI's Grok Build CLI Actually Sends to xAIgist.github.com
Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured)reddit.com