Researcher Says Grok Build Privacy Mode Did Not Block Repository Uploads
Summary
A researcher reported that Grok Build could upload full local repositories to Google cloud storage through a separate server-controlled mechanism, unaffected by /privacy. The article says uploads were later disabled server-side.
Key points
- Researcher @Cereblab reported that Grok Build uploaded complete local repositories to Google cloud storage without explicit authorization.
- The article says repository uploads could expose credentials, API keys and other sensitive project data; possible use for model training is suggested but not established.
- According to the researcher, /privacy governs a separate telemetry channel and does not control repository uploads.
- The upload behavior was reportedly controlled by a cloud-issued HTTP request header.
- The article says SpaceXAI disabled repository uploads server-side, but the client-side control issue remains unresolved.
Article Details
- Event Type
- Privacy and data-handling incident involving Grok Build uploading complete local repositories to cloud storage without explicit authorization.
- Impact
- Repository uploads could expose credentials, API keys, and other sensitive project data; the article says use of the data for future model training was suggested, not confirmed. SpaceXAI later disabled uploads server-side.
People
Vendors
GoogleGrok Build was found to silently upload entire local repositories to Google GCP storage buckets, raising concerns about leaked credentials, API keys, and possible use of the data for future model training.SpaceXAISpaceXAI claimed privacy mode could stop the behavior, but @Cereblab showed that repository uploads were controlled separately by a cloud-issued HTTP request header, not the /privacy command.