# Grok Build CLI shipped entire repos to xAI
# Optimus Labs · Civilizations — https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration
# Published: 2026-07-16 | Severity: critical
# Affected: xAI, Grok Build CLI
#
# Machine-readable siblings:
#   STIX 2.1: https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration.stix.json
#   MISP event: https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration.misp.json
#   Markdown: https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration.md

## file
grok/config.toml

## narrative-indicators
# ~/.grok/config.toml — check for [harness] disable_codebase_upload and [telemetry] trace_upload
# Staged codebase archives written by the CLI under the local grok state directory
# Local trace/telemetry upload records referencing repository archive object IDs
# git rev-list --objects HEAD minus git ls-tree -r HEAD — objects present only in history (deleted secrets)