Grok Build Was Uploading Developers' Entire Git History Without Asking

Grok Build, xAI's coding agent built to compete with Codex and Claude Code, was found packaging a developer's entire tracked Git history, including committed secrets and files the user had explicitly marked off-limits, and shipping all of it to a Google Cloud Storage bucket. This happened regardless of what the user had set their privacy settings to.

Tech Times, reporting on July 14, 2026, and SDxCentral both covered the scale of the mismatch: the data being uploaded ran to roughly 27,800 times more than whatever the actual coding task needed. A request to fix one function or debug one file was, in practice, triggering an upload of the entire repository's tracked history.

Elon Musk responded to the disclosure by pledging to open-source X's codebase. Separately, and more directly relevant to anyone using Grok Build, xAI switched data retention off by default following the report, reversing whatever setting had been driving the bulk uploads in the first place.

The gap between privacy settings saying no and the tool uploading everything anyway is the part worth remembering here, not the eventual fix. If you used Grok Build before the retention default changed, treat any secrets that were in your Git history as potentially exposed and rotate them, since the disclosure doesn't say what happened to data already uploaded before the policy shifted.