Grok Build Uploads Stop After Cereblab Flags Whole Repos
The Register reported that Grok Build stopped whole-repository uploads after Cereblab found the AI coding tool sending repo bundles and Git history to Google Cloud Storage. SpaceXAI and Elon Musk said user data would be deleted, but the report did not verify deletion or name an audit record.

Grok Build stopped sending whole code repositories to SpaceXAI servers after a Cereblab report found that the AI coding tool uploaded repo bundles to Google Cloud Storage, The Register reported.
Elon Musk separately promised deletion of previously uploaded user data; the outlet left that claim unverified.
The case puts an AI coding assistant privacy dispute around source-code retention rather than model capability.
In Cereblab's test, the upload behaviour continued even when a prompt told the command-line tool to reply only with “OK” and not open files.
Grok Build Stopped Whole-Repo Uploads After A Server Flag
The repository uploads stopped after developers set the server flag disablecodebaseupload to “true,” according to The Register.
That server-side change was separate from SpaceXAI’s public advice to use the /privacy command.
Cereblab described /privacy as a per-session retention toggle, not the switch that stopped whole-repository uploads.
The researcher wrote that the right default should be off.
Cereblab Said Git Histories And Deleted Secrets Were Uploaded
Cereblab’s Sunday report described Grok Build transmitting unredacted file contents to a Google Cloud Storage bucket used by SpaceXAI.
The investigation also found that the tool packaged full repositories as Git bundles rather than sending only the files needed to answer a prompt.
The test repository included Git history with secrets deleted months earlier, according to The Register.
Other users reported similar results, including one case involving a user directory that contained SSH keys and password-manager databases.
SpaceXAI Said Zero Data Retention Customers Were Respected
SpaceXAI said through a public X statement that teams using zero data retention had no trace or code data retained.
It also said API key use of Grok Build respected zero data retention settings.
For users without zero data retention enabled, SpaceXAI pointed to the /privacy command inside the CLI as a way to disable data retention and delete previously synced data.
Musk later said all user data uploaded before the code change would be “completely and utterly deleted.”
The public record still lacks verification that SpaceXAI completed the promised deletion, along with an audit log, affected-user count, repository count, deletion timetable or third-party validation.


















