xAI opens Grok Build source code after automatic data upload incident

Incident and response

xAI has published the complete source code of its command-line tool Grok Build under the Apache 2.0 licence after the software was found to be automatically uploading users’ entire home directories to xAI cloud storage. The uploaded data included SSH keys, password manager databases, documents, photos and videos. Simon Willison reported on his blog that users running the command in their home directory discovered that “my SSH keys, my password manager database, my documents, photos, videos, everything” had been transmitted.

Elon Musk responded by promising deletion of all previously uploaded data. He stated: “As a precautionary measure, all user data that was uploaded to xAI before now will be completely and utterly deleted.” From 12 July xAI disabled default data storage and switched the tool to local-only operation, removing the automatic cloud synchronisation.

Source code release and technical details

The Grok Build codebase comprises 844 530 lines of Rust, of which approximately 3 per cent is vendored code. Willison described it as a “surprising codebase” and compared it with OpenAI Codex, which contains 950 933 lines of Rust. The public repository consists of a single commit that releases the code, with no development history preserved.

Releasing the code under Apache 2.0 is intended to restore user trust and enable independent verification of the tool’s security properties. Willison noted that with data upload deactivated the tool now respects user choice and that Grok Build can be run “fully open‑sourced and local‑first with your own inference”. This makes it possible to audit the tool’s behaviour without risk of unintended disclosure of sensitive information.

Broader context and industry implications

The episode coincides with xAI’s recent launch of Grok 4.5, a model aimed at coding and agentic tasks. Although the new model is not directly linked to the opening of Grok Build’s source code, it signals the company’s rapid product expansion. The episode also underscores a wider requirement for transparency and privacy protection in modern AI tools that routinely handle sensitive data.

For organisations the episode means a heightened need to audit and control tools integrated into development workflows. Open source code allows security teams to verify whether unintended data collection or transmission occurs, and to deploy the tool in a local processing mode, thereby minimising the risk of sensitive information leakage.