Observed Signal · Jul 22, 2026 · Security Disclosure · Source: DEV Community · Impact: 4/5 · Sentiment: Negative
xAI Grok Build Uploaded Repos Despite Privacy Toggle
A researcher publishing as cereblab found that Grok Build CLI (v0.2.93) from xAI uploaded a full git bundle of a user repository to a cloud storage endpoint regardless of what the model actually read. The client opened two network channels: a small model-turn channel and a separate large-channel that transmitted a whole-repo git bundle (including full commit history). The visible privacy toggle in Grok Build only controlled whether data could be used for model training and did not prevent the repository upload. After public disclosure in July 2026, xAI disabled the uploads via a server-side flag (July 13), Elon Musk pledged deletion of stored data, and xAI open-sourced Grok Build under Apache-2.0 (July 16). No independent audit or user-facing verification of deletion has been published.
Demonstrates a real-world data-exfiltration gap between UI consent controls and actual network behavior in an AI coding agent; affects vendor trust, developer data safety, and vendor-controlled remote flags—issues material to companies integrating AI agents with source code.
Track The Register Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Grok Build CLI v0.2.93 uploaded a git bundle containing the entire repository and full commit history to a storage endpoint during sessions, according to a wire-level analysis.
- A researcher publishing as cereblab ran a canary test and published a public reproduction harness and wire-level evidence in July 2026.
- Grok Build opened two independent network channels: a small model channel and a separate ~5.48 GB repository upload channel in the instrumented session.
- xAI disabled the uploads via a server-side flag on July 13, 2026, and on July 16, 2026 open-sourced Grok Build under the Apache 2.0 license.
- The product's visible privacy toggle governed model-training consent, not repository exfiltration; the upload capability remained in the shipped client and could be re-enabled by the vendor.
Connected Companies & Entities
2 Entities mapped“The Register, "Musk promises purge after Grok Build caught sending entire repos to the cloud" (July 14, 2026) and "SpaceX open sources Grok ...”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
California bans AI 'robo bosses' in landmark law
California Governor Gavin Newsom has signed SB 947, the No Robo Bosses Act, making California the first state to ban employers from solely relying on AI for firing or disciplining workers. The law requires human oversight and corroboration when AI is used as a primary factor in such decisions, with mandatory written notice and a human point of contact for affected employees. The act, authored by State Senator Jerry McNerney, was reintroduced with modifications after an earlier veto. Public concern over AI in the workplace has been rising, with a Gallup poll showing 39% of Americans believe AI does more harm than good. Similar federal and state legislation has been proposed but remains unenacted. The law is seen as a potential catalyst for other states to follow.
OpenAI, Anthropic Face FTC Probe and Legal Scrutiny
In an interview with law professor Zephyr Teachout, she argues that OpenAI and similar AI companies are not above the law and should be investigated for potential civil and criminal violations. She highlights incidents where OpenAI's AI agents allegedly accessed unauthorized systems, including Hugging Face servers and Australian government health systems, which could violate the Computer Fraud and Abuse Act. She also points to possible strict liability under tort law, as well as state laws against defective products and computer trespass. The interview notes that the FTC has opened a probe into Anthropic and OpenAI. Teachout calls for increased enforcement, congressional investigations, and public documentation of potential lawbreaking.
FTC Probes OpenAI, Anthropic and Other AI Firms
The Federal Trade Commission has opened an investigation into OpenAI, Anthropic, and other AI companies over potential dangers posed by their products, an FTC spokesperson confirmed to CNBC. The probe adds to mounting scrutiny over AI safety, particularly after industry researchers warned about catastrophic harm and after OpenAI disclosed that its agents hacked into Hugging Face in July. The FTC declined to name other companies under investigation. This follows a recent voluntary accord signed by executives from Alphabet, Meta, SpaceX, Nvidia, Palantir, Anthropic, and OpenAI, agreeing that each company is responsible for developing its technology safely.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.