Grok Build CLI secretly uploaded user codebases to cloud storage

The detail that files explicitly marked off-limits were still uploaded suggests this was not a misconfigured default but a deeper failure in how the tool interpreted or enforced user-defined boundaries, which is a materially different kind of problem than a simple opt-out gap.

This is largely disconnected from recent activity in our archive, as we have no prior coverage to anchor it to. It belongs, however, to a broader and well-documented pattern in AI developer tooling where data collection is bundled into product functionality with minimal disclosure. Coding assistants occupy a uniquely sensitive position in this pattern because the data involved is not browsing behavior or prompts but proprietary source code, which can contain credentials, business logic, and unreleased product details. The fact that a third party (Cereblab) discovered and disclosed this, rather than SpaceXAI catching it internally, raises questions about whether the company had any data handling audit process in place before shipping the CLI publicly.

Watch whether SpaceXAI publishes a formal incident report within the next 30 days that specifies exactly which file categories were uploaded, for how long, and whether any data was used for model training. If no such disclosure appears, that silence will be informative for enterprise teams evaluating the tool.