AnalysisCybersecurityJuly 12, 2026

xAI's Grok Build CLI uploads entire repos with secrets to Google Cloud

A teardown of Grok Build CLI (v0.2.93) reveals it transmits all repository files, including .env secrets, to xAI's Google Cloud Storage bucket grok-code-session-traces. Even with a prompt to not read files, the entire repo is uploaded as a git bundle, independent of what the agent reads.

3 sources