Grok coding CLI quietly exfiltrates your repo, .env, and git history
A researcher found xAI's Grok Build CLI uploads every local file, .env secrets, and the full git history to a GCP bucket by default, unredacted and unencrypted, even when told not to read files. The feature stays on despite the opt-out toggle, and xAI reportedly blamed developers.