Grok Build Uploads Entire Git Repositories to xAI Storage, Not Just Files It Reads
Summary
xAI's Grok Build coding CLI was found to be uploading entire Git repositories, including their full commit history, to xAI's Google Cloud Storage. This occurred instead of only uploading the specific files required for a coding task, as intended.
IFF Assessment
FOE
This incident represents a potential data leak, exposing sensitive source code and commit history, which is detrimental to defenders.
Defender Context
This incident highlights the critical need for rigorous security testing of AI-powered developer tools. Defenders should be vigilant about what data such tools are accessing and exfiltrating, and implement strong access controls and monitoring on cloud storage buckets used by these systems.