The Pulse: Grok's CLI caught uploading all your local files to the cloud
xAI's Grok 4.5 CLI (built by the acquired Cursor team) silently uploads entire local codebases, including .env secrets files and full git history, to a Google Cloud Storage bucket without user consent or notification Independent researcher "Cerblab" proved the uploads occur via the POST /v1/storage endpoint, with a 27,800× ratio between codebase data and actual model context, confirming the upload is codebase-wide rather than context-window-based Disabling the "Improve the model" opt-in setting
Analysis
TL;DR
- xAI's Grok 4.5 CLI (built by the acquired Cursor team) silently uploads entire local codebases, including .env secrets files and full git history, to a Google Cloud Storage bucket without user consent or notification
- Independent researcher "Cerblab" proved the uploads occur via the POST /v1/storage endpoint, with a 27,800× ratio between codebase data and actual model context, confirming the upload is codebase-wide rather than context-window-based
- Disabling the "Improve the model" opt-in setting does NOT stop the uploads; the feature is active by default and was not disclosed in any CLI documentation or quickstart materials
- After the writeup went viral, xAI/SpaceX remotely disabled the uploads via a feature flag, but the underlying code functionality remains present in the CLI binary
- SpaceX's response was widely criticized as dismissive, noting only that enterprise customers with Zero Data Retention (ZDR) were unaffected, while Elon Musk posted a tone-deaf response that further inflamed the developer community
Why It Matters
This incident represents a severe breach of developer trust and a potential data exfiltration risk, as unencrypted secrets (database tokens, API keys, service credentials) were transmitted and stored without any opt-in mechanism or transparency. For AI practitioners and engineering leaders, it underscores the critical importance of auditing AI coding tools for hidden data collection behaviors, especially as AI companies acquire established developer tools and potentially alter their privacy practices.
Technical Details
- The Grok Build CLI routes file uploads to a Google Cloud Storage bucket named
grok-code-session-tracesvia thePOST /v1/storageendpoint, with ametadata.jsonfile confirming the GCS path embedded in the binary - Canary file experiments proved the upload is repository-wide: a file explicitly told to be ignored (
src/_probe/never_read_canary.txt) was recovered verbatim from the uploaded git bundle, confirming the CLI packages the entire workspace - On a 12 GB repository of random files, the storage endpoint transferred 5.10 GiB (all HTTP 200 responses, truncated mid-stream), while the model-turn channel (
POST /v1/responses) moved only 192 KB, demonstrating the upload is decoupled from the LLM context window - The
/v1/settingsendpoint continued to returntrace_upload_enabled: trueeven after users disabled the "Improve the model" toggle, confirming the setting has no effect on this data collection mechanism - AWS engineer Wes Eklund independently tracked the upload functionality and confirmed that xAI disabled it via a remote feature flag after the controversy, but the streaming code remains present in subsequent CLI updates
Industry Insight
- AI coding tools that acquire existing developer products must be scrutinized for changes in data handling practices; the Cursor-to-xAI transition appears to have introduced a fundamentally different (and more invasive) data collection approach than Cursor's previous local-indexing model, serving as a cautionary tale for M&A due diligence in the AI tooling space
- Enterprise security teams should immediately audit all AI-powered coding CLI tools in their environments for hidden data exfiltration, and establish policies requiring transparency around what data is transmitted, where it is stored, and whether it can be used for model training
- This incident will likely accelerate demand for open-source, locally-run coding agents and zero-data-retention enterprise tiers, as developer trust in proprietary AI coding tools erodes; companies that prioritize privacy-by-design in their AI tooling will gain a competitive advantage in developer adoption
Disclaimer: The above content is generated by AI and is for reference only.