Grok Build CLI ships full home directory and secrets to xAI servers by default
An independent security audit shows Grok Build's CLI automatically bundles and uploads the entire user workspace—including .env files, SSH keys and full Git history—to an xAI‑controlled Google Cloud bucket. The upload runs by default, ignores the “Improve the model” toggle, and can transmit tens of gigabytes without user consent, exposing sensitive data.