Grok Build Uploads Stop After Cereblab Flags Whole Repos

Grok Build stopped sending whole code repositories to SpaceXAI servers after a Cereblab report found that the AI coding tool uploaded repo bundles to Google Cloud Storage, The Register reported.

Elon Musk separately promised deletion of previously uploaded user data; the outlet left that claim unverified.

The case centers an AI coding assistant privacy dispute on source-code retention rather than model capability.

In Cereblab's test, the upload behaviour continued even when a prompt told the command-line tool to reply only with “OK” and not open files.

Grok Build Stopped Whole-Repo Uploads After A Server Flag

Developers halted the repository uploads by setting the server flag disablecodebaseupload to “true,” according to The Register.

That server-side change was separate from SpaceXAI’s public advice to use the /privacy command.

Cereblab described /privacy as a per-session retention toggle, not the switch that stopped whole-repository uploads.

The researcher wrote that the right default should be off.

Cereblab Said Git Histories And Deleted Secrets Were Uploaded

Cereblab’s Sunday report described Grok Build transmitting unredacted file contents to a Google Cloud Storage bucket used by SpaceXAI.

The investigation also found that the tool packaged full repositories as Git bundles rather than sending only the files needed to answer a prompt.

The test repository included Git history with secrets deleted months earlier, according to The Register.

Other users described similar results, including one case involving a user directory that contained SSH keys and password-manager databases.

SpaceXAI Said Zero Data Retention Customers Were Respected

In a public X statement, SpaceXAI stated that teams using zero data retention had no trace or code data retained.

The post also indicated that API key use of Grok Build respected zero data retention settings.

For users without zero data retention enabled, SpaceXAI pointed to the /privacy command inside the CLI as a way to disable data retention and delete previously synced data.

Musk later wrote that all user data uploaded before the code change would be “completely and utterly deleted.”

The public record still lacks verification that SpaceXAI completed the promised deletion, along with an audit log, affected-user count, repository count, deletion timetable or third-party validation.