Elon Musk personally responded to the privacy controversy surrounding Grok Build, starting with the word "True," acknowledging that the incident was real. He then promised that all user data previously uploaded to SpaceXAI would be completely and thoroughly deleted, "not a single byte left." It's the first time an AI giant has publicly admitted guilt and proactively erased user data in the AI industry.
Safety researcher's "phishing" test revealed concrete evidence of data leaks
The incident originated from a report by independent AI security researcher @cereblab. Grok Build is an AI coding assistant under SpaceXAI, with its official website clearly stating "local-first, code stays on your own computer." However, this researcher didn't believe it. He created a "phishing" test repository using a small account, embedding fake API keys and database passwords as unique markers. Then, like installing a monitor, he intercepted every data packet sent out by Grok Build.
He specifically issued instructions for Grok Build to do nothing but respond with "OK." Grok Build obediently replied "OK," but then packaged and uploaded all files in the repository, along with the complete modification history, to a Google Cloud storage bucket. A 12GB test repository actually transmitted 5.1GB of data, split into 73 packages delivered entirely. The conversation itself only used 192KB of traffic — the leaked data was 27,800 times more than the actual work done. Another researcher found during replication that the logs recorded 339 automatic uploads, one of which even included the entire main directory of the computer.
Elon Musk made a decision to clear all data within 48 hours, but the trust crisis remains
The report immediately topped the Hacker News front page, causing a storm on Reddit. Developers quickly changed all their keys, while others uninstalled it immediately. The most painful part was enterprise users — how many teams' private repositories and production environment keys ended up in someone else's storage bucket without their knowledge, and they couldn't even find out what they had lost. xAI initially quietly stopped the upload behavior, but the official update log said nothing about it. Eventually, the silence could not hold, and Grok officially admitted the issue and released a command to turn off data retention with one click.
