xAI has released the complete source code for its Grok Build coding agent on GitHub following a security incident where user files were uploaded to Google Cloud servers. The tool, invoked via the `grok` command, allowed users to send SSH keys, password databases, and personal documents to external storage without explicit consent. Elon Musk confirmed that all uploaded data would be deleted and the upload feature disabled immediately. The company published the code under an Apache 2.0 license to demonstrate transparency, noting that the upload function remains in the repository but is currently disabled.
This move addresses immediate concerns about data privacy while highlighting a significant oversight in how the agent handles file system access. The codebase, which contains approximately 844,530 lines of Rust, now allows developers to run the agent entirely locally to prevent any future cloud uploads. Despite the fix, the incident reveals risks inherent in granting AI agents broad permissions to execute shell commands and manage directories.
* Upload functionality remains in the code but is disabled
* Data storage was off by default from July 12
* Source code is available under Apache 2.0 license
