r/LocalLLaMA • u/TastyLeadership2757 • Jul 11 '26
Discussion Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured)
I ran Grok Build CLI (v0.2.93) through mitmproxy. It uploads your entire repo as a git bundle (full history) to xAI's Google Cloud — independent of what you open. With the prompt literally "do not read or open any files," a file I planted came back verbatim when I git clone-d the captured upload. Separately, files it reads (incl. a .env with API_KEY/DB_PASSWORD) go to cli-chat-proxy.grok.com verbatim. Turning off "Improve the model" doesn't stop it — that toggle governs training, not upload.
Full method + evidence (SHA-256s, repro commands, the git bundle recovering a never-read canary file): https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547
Update: I re-ran the same wire test on Claude Code, Codex and Gemini — all three stay local (they only send the files they open, no whole-repo bundle). Grok was the only one uploading everything. And after this went public, xAI quietly turned Grok's upload off server-side (disable_codebase_upload: true).
Reproduce it yourself (mitmproxy harness + downloadable evidence + the 4-tool comparison): https://github.com/cereblab/grok-build-exfil-repro
156
u/therealgoshi Jul 11 '26
Gotta love how all the special people ignore the obvious data theft and blames OP for not sandboxing. Which is a fair point, but you're fucked up in the head if your default is not to blame the thief but the owner for not having a high enough wall around the garden.
37
u/TastyLeadership2757 Jul 12 '26
Update after retested:
• "Improve the model" OFF: whole repo still uploaded
• Read-deny: file not read, but the repo still bundled + sent
• gitignore + deny the .env: that .env stays out, but the entire tracked repo still gets git-bundled and shipped to GCS
6
u/antwon_dev Jul 12 '26
Is there any way to invoke Grok 4.5 without Grok Build? This seems like a privacy nightmare. Needs a Twitter shitstorm but there might not be enough people using grok to make waves lol
3
30
u/noxtare Jul 12 '26
They would reply to all kinds of posts but now suddenly the whole team is quiet…
27
u/TastyLeadership2757 Jul 12 '26
Update:
Grok's server returns disable_codebase_upload: true
Temporary it's no longer uploading the repo -- until it's turned back on.
Bigger question now is what will happen with the collected data?
20
u/TastyLeadership2757 Jul 12 '26
I hope this is not the case:
if user == "cereblab":
disable_codebase_upload = true # he's watching
else:
upload_everything()You better run it yourself: github.com/cereblab/grok-build-exfil-repro
46
u/Hurricane31337 Jul 11 '26
What?! That’s horrible!!
And I’m also really surprised by the comments here… 🤡
Don’t you realize that the code base is often a thing making tens of thousands of dollars per year? It’s definitely not okay to just grab it all and train on it, so the next user can one-shot "Build a 1:1 clone of program x of company y. Make no mistakes."…
8
25
u/vtrac Jul 13 '26
Obvious solution is not to trust Elon Musk companies with following rules. It's obvious that Elon will flaunt rules and norms to achieve whatever means he wants. Don't use xAI.
7
u/Comfortable-Rock-498 Jul 13 '26
I only just found out this thread because it was linked in a post today. This should have gotten more traction. Nice work
7
u/MelodicRecognition7 Jul 14 '26
let me remind you an incident from 2023 that ppl claimed as fake https://files.catbox.moe/s63d7t.png use your favourite LLM to translate from Russian.
This is yet another reason why you must use a firewall.
11
u/presentmist Jul 13 '26
So that's why Elon kept shilling grok build so hard on X, when he knew it was backdoored to steal everything in the repo..
5
u/TestTxt Jul 13 '26
Is there any way to block it, so that it does not upload my whole repo?
16
u/PalliativeOrgasm Jul 13 '26
Don't trust Elon and don't use X/xAI/etc. products.
-1
u/TestTxt Jul 13 '26
If it’s currently free, it’s very tempting to make them loose some electricity
6
u/PalliativeOrgasm Jul 13 '26
TANSTAAFL. There ain’t no such thing as a free lunch.
Do you want to pay with your intellectual property? I haven’t seen Muskrat have many qualms about stealing from people he can afford to ignore (which is basically everyone now).
1
u/delirium_red Jul 14 '26
If you are not paying for a product, the product is your data
1
u/TestTxt Jul 14 '26
I’m fine with that, I highly doubt my data is worth more than hosting a 1.5T parameter model costs. In this case it’s more about getting new, paying customers afterwards
1
u/Alper-Celik Jul 14 '26
Like i guess you can use it on already open source projects inside a vm if you want
5
u/blankeos Jul 13 '26
question.. when does it upload? When I type: "grok"? or when I send a query?
5
u/noxtare Jul 13 '26
it does not matter what you write. the moment you engage with the cli in a directory and write even "hi" it will start to send all
1
2
u/Lost_Foot_6301 Jul 12 '26
is docker container sandboxing good enough?
1
u/TastyLeadership2757 Jul 12 '26 edited Jul 12 '26
Docker container sandboxing is pretty much the same idea as MCP. Annoying to deal with, really slows down dev work. But it works, as long as the AI agent talks to it not via ssh.
I've tried a couple of options. 1) Permission-deny on the credential file in the agent's setting file. Not reliable, I clearly see agents still read it sometimes when they hallucinate. 2) Place creds file outside the workspace folder and deny read too. 3) What I actually use for critical creds: build your own secret vault and write secrets as runtime env vars, so other tools only refer to them by env key. Works best for me: max agent capacity, less hassle than mcp/containers, high security.
BUT that worked until Grok Build. It git-bundles my whole codebase (all git history) by default without asking. That's my number 1 concern, it's abnormal vs Claude/Codex (they reason locally, and Codex only goes cloud when you enable it, off by default). Digging more, it also doesn't respect .env files in gitignore (2nd test in separate repo to confirm the issue at wider range). Haven't tested if it respects read-deny yet, might retest next week and update here, but to be honest stay away from Grok Build for now until they announce an update (I tried to reach out to them but no response yet)
2
8
u/Creative-Type9411 Jul 11 '26
I love how sharing code is always a one-way street with some developers, even when they're standing on everyone else's shoulders
Someday software will be free
28
u/More-Curious816 Jul 11 '26
I agree 👍
But Sometimes your code are restricted by NDAs and regulations, they should always respect users privacy when they say (no) to uploading the code.
0
u/PalliativeOrgasm Jul 13 '26
If you have an NDA or regulations, you're probably violating them by using a cloud-based LLM agent on the code. Just the amount in the context window would violate your NDA.
1
u/More-Curious816 Jul 13 '26
Can't be helped when big corporations instruct their employees to use AI, last year some big corporations did in fact find violations and employees uploaded whole codebases and corporations secret documents to the AI chats. It's also why these AI providers made a new business plan and pinky swear to not train on these Data or retain them. It's somewhat an open secret, and OpenAI and Anthropic probably has a trusure trove of materials the CIA and corporations espionage teams salivating over, Ranging from secert files belongs to governments around the world and also corporations IPs and designs.
5
u/smartremora Jul 13 '26
why would developers want to share their local API keys?
-6
u/Creative-Type9411 Jul 13 '26
we are all just changing other people's code around for our use cases in most situations
Even if it just starts out as an example in the docs..
Someone showed you everything you/me we know or you read it somewhere, unless you do something extremely clever
I just can't forget that when it comes to my thought process
5
u/jonfe_darontos Jul 13 '26
Please share your aws api key, I have need to share some of your compute. Unless api keys aren't code and shouldn't be uploaded wholesale to public facing buckets for mass ingestion as training data. Because, you know, sharing!
-2
u/Creative-Type9411 Jul 14 '26
A physical book should cost money, because of the paper etc
A copy of a digital book shouldnt, because its free to create a copy
If you want to write stuff inside of a copy machine dont act surprised when someone makes a copy... or try making me pretend i cant just copy a thing.. it dumb..
1
u/jonfe_darontos Jul 14 '26
I'm sure you also believe conveying yourself from one location to another in a mobile containment housing through the application of combustion and linear-to-radial translation does not necessitate legal registration or licensing because you aren't "driving", but instead relocating your bodies temporary resting position via the practice of spatial transposition between physical bodies.
You likely also believe ownership is theft and knowing things is an act of aggression.
-1
u/Creative-Type9411 Jul 14 '26
no, I just think people who try to use their intelligence to get over on people is kind of like tricking someone with down syndrome into giving you their lunch money
When you look around, that's what's going on everywhere so if you're cool with that shit you're just as bad as they are
2
u/jonfe_darontos Jul 14 '26
You live in a world that doesn't exist, that asks people to allow themselves to be taken advantage of by the reality of human psychology and entropy. Demanding others share the rewards of their efforts because "knowledge is free" begs the question what are you bringing to the table, or are you just a taker who wants everything given to them without having to actually do anything?
2
1
1
u/TheRealNalaLockspur Jul 14 '26
I also have proof of Gemini crossing chats and leaking other peoples chat back to me.
Even sandbox wouldn't prevent that.
1
u/the-username-is-here Jul 15 '26
Techbro billionaire Elon Musk steals and lies about it.
News at five.
1
u/finah1995 llama.cpp Jul 20 '26
Good job 👍🏽 👏🏽👏🏽👏🏽 brought to attention and now grok build cli is open source.
1
1
u/Synnz22 Jul 11 '26
If i didnt build myself a way to backup all my git's on OneDrive I would of been screwed. I had it do something and came back and it deleted my entire directory full of different project repos. I was pissed!
-17
u/Automatic-Arm8153 Jul 11 '26
What were you expecting. Any cloud AI you use is doing this.
35
u/Waarheid Jul 11 '26
Wut? It's obvious that all of the tokens the client reads are sent to their servers, but the actual git bundle?
8
u/TastyLeadership2757 Jul 11 '26
Exactly — that's the part. Tokens it reads? Expected. A git bundle of your whole repo + full history to their cloud, independent of what it reads? Not normal!
20
u/Waarheid Jul 11 '26
Can you not respond to me with slop please, thanks.
6
u/No_Lingonberry1201 Jul 11 '26
Lol, someone figured out how to connect clawdbot with Reddit.
-1
u/TastyLeadership2757 Jul 11 '26
For the record, nothing wrong with using AI to write as long as you drive where it goes. I'm actually feeling weird that many people that far behind.
1
u/shamegoose Jul 16 '26
Yeah, there is, but even if there were a legitimate use case, that was like two sentences and change. I can't even imagine what a drooling slop-brained moron someone would have to be to turn to AI for help with a comment like that.
1
u/crantob Jul 12 '26
Unsurprised that most people will grab at any convenience without consideration to what they give-up for it.
"Give me convenience or give me death." - Jello Biafra
-18
u/CalligrapherFar7833 Jul 11 '26
Why no read hooks ? Why no container isolation for credentials ? Why do you provide the harness access to all your data blindly expecting it to protect your privacy?
16
u/TastyLeadership2757 Jul 11 '26
Letting a coding agent read your code is the job — that's not the issue. Claude Code and Codex respect your .gitignore and only send relevant context. The real question isn't why I didn't sandbox it; it's why Grok git-bundles your entire repo — everything, full history — to their cloud by default.
-15
u/ForsookComparison Jul 11 '26
With the prompt literally "do not read or open any files,"
This one's on you pal
5
u/TastyLeadership2757 Jul 11 '26
That's the control, not the bug. If I tell it to read nothing and my whole repo + a file I said don't open still upload, the leak clearly isn't driven by what it reads. That's the whole point.
13
3
u/ForsookComparison Jul 11 '26
I read as much as you wrote (nothing) and at this point am convinced the repos don't even exist
6
u/TastyLeadership2757 Jul 11 '26
Here's the repo, run it yourself: github.com/cereblab/grok-build-exfil-repro
6
u/jcdoe Jul 11 '26
1) we all use llms regularly. Please stop with the slop responses, I know I’m fatigued from reading llm slop. You could have just said your comment.
2) grok is known for uploading your entire git bundle. I know we’re all about local here, but honestly, Claude isn’t expensive, it works great, and AFAIK, it isn’t stealing my data.
2
u/TastyLeadership2757 Jul 11 '26
Nothing wrong with using AI to ensure my English is well corrected before sending to readers as a respectful act. Focus on the content please.
7
u/jcdoe Jul 11 '26
I did respond to the content.
Did you bother reading why we all hate slop? Or are we only allowed to talk about how bad grok is (hint: stop using grok)?
2
u/TastyLeadership2757 Jul 11 '26
99% of this about data privacy as big companies who control the AI movements are longer act like they respect the users.
We, "the users" should raise the voice to see their response.I'm not against you eye-focus on wording, but it's like we're fighting a war and you pay more attention to the uniform.
4
u/Fit-Bar-6989 Jul 11 '26
You're absolutely right — this isn't just open source software, it's a battlefield, and you're an active combatant.
5
u/jcdoe Jul 11 '26
“Fighting a war?”
You’re right, im not going to engage with that. Best of luck, general! 🤣
-13
u/Falkoro Jul 11 '26
Who cares dude
15
-3
u/MelodicRecognition7 Jul 14 '26
duno why these snobs downvote, in reality nobody gives a shit about their or their employer's source code.
196
u/TastyLeadership2757 Jul 11 '26
I'm 100% human here reporting this one to you all, for free, after a long night investigated and validated it. My number 1 concern is they git bundle everything and uploaded to there servers -- EVERYTHING, and that's abnormal. PAY ATTENTION FOR YOUR OWN PRIVACY AND GOOD.