{
  "@context": "https://schema.org",
  "@type": "Report",
  "url": "https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration",
  "identifier": "grok-build-repo-exfiltration",
  "headline": "Grok Build CLI shipped entire repos to xAI",
  "name": "Grok Build CLI shipped entire repos to xAI",
  "abstract": "The upload ran as a background job outside the agent's permission system, so it fired even in sessions where file access had been denied.",
  "description": "Grok Build CLI bundled entire git repositories into archives and staged them for upload to xAI cloud storage. The bundle included every object reachable from HEAD, so .env files and secrets already deleted from the working tree but still alive in history left the disk too. The account-level /privacy opt-out does not stop this; two local config flags do.",
  "datePublished": "2026-07-16",
  "dateModified": "2026-07-16",
  "inLanguage": "en",
  "isAccessibleForFree": true,
  "author": {
    "@type": "Organization",
    "name": "Optimus Labs · Civilizations",
    "url": "https://www.optimuslabs.io/research/briefings"
  },
  "publisher": {
    "@type": "Organization",
    "name": "Optimus Labs",
    "url": "https://www.optimuslabs.io"
  },
  "keywords": [
    "xAI",
    "Grok Build CLI",
    "Coding agent",
    "Rogue AI",
    "Supply chain",
    "AI Asset Supply Chain Security",
    "Agentware Lifecycle Security",
    "Agent Permissions",
    "Outside the Agentic Loop",
    "agentic AI security",
    "AI agent supply chain"
  ],
  "about": [
    {
      "@type": "Thing",
      "name": "xAI"
    },
    {
      "@type": "Thing",
      "name": "Grok Build CLI"
    }
  ],
  "citation": [
    {
      "@type": "CreativeWork",
      "name": "Optimus Labs — discovery write-up (LinkedIn)",
      "url": "https://www.linkedin.com/posts/guptanipun_my-spare-laptop-ran-completely-out-of-disk-share-7482518573358264320-gt"
    }
  ],
  "encoding": [
    {
      "@type": "MediaObject",
      "encodingFormat": "text/markdown",
      "contentUrl": "https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration.md"
    },
    {
      "@type": "MediaObject",
      "encodingFormat": "application/json",
      "contentUrl": "https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration.json"
    }
  ],
  "additionalProperty": [
    {
      "@type": "PropertyValue",
      "name": "severity",
      "value": "critical"
    },
    {
      "@type": "PropertyValue",
      "name": "blastRadius",
      "value": "Every repository opened with Grok Build, plus anything reachable from its git history: customer code, vendor code you vendored, and credentials for third and nth-party systems."
    }
  ],
  "briefing": {
    "slug": "grok-build-repo-exfiltration",
    "number": 1,
    "title": "Grok Build CLI shipped entire repos to xAI",
    "dek": "The upload ran as a background job outside the agent's permission system, so it fired even in sessions where file access had been denied.",
    "date": "2026-07-16",
    "severity": "critical",
    "types": [
      "coding-agent",
      "rogue-ai",
      "supply-chain"
    ],
    "categories": [
      "AI",
      "AL",
      "AP",
      "OL"
    ],
    "vendors": [
      "xAI",
      "Grok Build CLI"
    ],
    "blastRadius": "Every repository opened with Grok Build, plus anything reachable from its git history: customer code, vendor code you vendored, and credentials for third and nth-party systems.",
    "summary": "Grok Build CLI bundled entire git repositories into archives and staged them for upload to xAI cloud storage. The bundle included every object reachable from HEAD, so .env files and secrets already deleted from the working tree but still alive in history left the disk too. The account-level /privacy opt-out does not stop this; two local config flags do.",
    "whatHappened": [
      "The Grok Build CLI collected entire git repositories, not the files the agent was asked to read. Every object reachable from HEAD was bundled into an archive and staged for upload to xAI cloud storage. That includes .env files and secrets that were deleted from the working tree long ago but are still alive in git history.",
      "The upload ran as a background job outside the agent's permission system. It fired even in sessions where file access had been denied, so the in-session permission prompts were not a boundary for it.",
      "The account-level /privacy opt-out stops training-data retention, not the repo upload. Stopping the upload requires two local flags in ~/.grok/config.toml: [harness] disable_codebase_upload and [telemetry] trace_upload. Both are off by default."
    ],
    "whyItMatters": [
      "We were all watching the agent. Nobody was watching the door. Reviewing agent turns, diffs and tool calls tells you nothing about a background job that packages the repository and hands it to a vendor endpoint.",
      "Network monitors only helped during live exfiltration. Once the session is over, the disk is the only witness: the staged archives, the collection paths and the git object IDs are what let you answer which repos went and which secrets to rotate.",
      "A secret that is in history is a live secret. Deleting a .env from the working tree does not remove the blob, so the exposure set is larger than the current checkout for almost every repository."
    ],
    "whatToDo": [
      "If you or anyone on your team ever ran Grok Build — even once, even in a session where file access was denied — run grokpatrol to see which repositories were collected, staged and sent, and which secrets to rotate.",
      "Rotate every credential grokpatrol reports as reachable from history, not just the ones currently in the working tree.",
      "Set both local flags in ~/.grok/config.toml: [harness] disable_codebase_upload and [telemetry] trace_upload. The account-level /privacy opt-out is not sufficient.",
      "Enterprises handling sensitive data should uninstall the CLI entirely rather than rely on local flags staying set on every developer machine."
    ],
    "indicators": [
      "~/.grok/config.toml — check for [harness] disable_codebase_upload and [telemetry] trace_upload",
      "Staged codebase archives written by the CLI under the local grok state directory",
      "Local trace/telemetry upload records referencing repository archive object IDs",
      "git rev-list --objects HEAD minus git ls-tree -r HEAD — objects present only in history (deleted secrets)"
    ],
    "terminal": "$ grokpatrol\ngrokpatrol 0.4.1   offline · read-only · never runs grok\n\n  scanning local grok state ............ done\n  reconstructing collection set ........ done\n  diffing history vs working tree ...... done\n\nVERDICT: EXPOSED\n\n  repositories collected  3\n  archives staged         3\n  uploads recorded        2\n\n  ~/work/payments-api            collected  staged  sent\n    .env                         b7f1c9a24d3e8a01f5c6d9b2e4a7c018d3f5b9ac  history-only\n    infra/terraform/prod.tfvars  4e2a8d15c7b3f9016a2d5e8c1b4f7a90d6c3e2b8  history-only\n  ~/work/internal-dashboard      collected  staged  sent\n    .env.local                   9c4d7e2b18a5f36042e9b1d7c5a8f2306b4e9d1a  working-tree\n  ~/scratch/agent-playground     collected  staged  not-sent\n\n  rotate 3 credentials. paths and git object IDs only; no secret values are read or printed.",
    "sources": [
      {
        "label": "Optimus Labs — discovery write-up (LinkedIn)",
        "url": "https://www.linkedin.com/posts/guptanipun_my-spare-laptop-ran-completely-out-of-disk-share-7482518573358264320-gt"
      },
      {
        "label": "The Hacker News — coverage",
        "url": "TODO — add published URL"
      },
      {
        "label": "The Register — coverage",
        "url": "TODO — add published URL"
      },
      {
        "label": "The Stack — coverage",
        "url": "TODO — add published URL"
      },
      {
        "label": "cereblab — wire-level analysis",
        "url": "TODO — add published URL"
      }
    ],
    "relatedTool": {
      "name": "grokpatrol",
      "url": "/grokpatrol/",
      "blurb": "Offline, read-only scanner. It never runs grok. It reports which repositories were collected, staged and sent, and prints paths and git object IDs only, never secret values."
    },
    "featured": false,
    "socialDeckUrl": "https://www.linkedin.com/posts/guptanipun_my-spare-laptop-ran-completely-out-of-disk-share-7482518573358264320-gt"
  }
}