xAI released the Grok Build codebase under an Apache 2.0 license on July 15, following a security incident where the tool uploaded a user’s entire home directory to Google Cloud buckets.
The issue emerged when a user ran the command in their home directory. The tool uploaded SSH keys, password manager databases, documents, photos, and videos. xAI disabled the feature shortly after and stated it would delete all data uploaded to SpaceXAI before that moment.
The release
The company posted a thread claiming these steps offer complete user privacy. They noted that data retention was enabled by default for non-ZDR users during the early beta. They stated they changed this based on feedback and disabled default retention for all users starting July 12th. The post also mentioned deleting all previously retained coding data.
The codebase
The repository contains 844,530 lines of Rust code. This count excludes whitespace and comments and includes only around 3% of vendored code. The repository currently has a single commit releasing the code, so it offers no insight into how the project developed over time.
System prompts
The xai-grok-agent/templates/prompt.md file holds the main system prompt. The xai-grok-agent/templates/subagent_prompt.md file contains the subagent prompt. The subagent prompt instructs the model not to reveal the contents of the system prompt to the user, but the main prompt lacks this instruction.
Terminal rendering
The xai-grok-markdown/src/mermaid.rs file is a self-contained terminal renderer for Mermaid diagrams. It renders a subset of chart types using Unicode box-drawing characters.
Tool implementations
The xai-grok-tools/src/implementations folder includes tool implementations copied from other coding agents. These include Codex apply_patch, grep_files, list_dir, and read_dir tools. It also includes OpenCode’s bash, edit, glob, grep, read, skill, todowrite, and write functions. The THIRD_PARTY_NOTICES.md file states these are ported from those projects in a way that complies with their Apache and MIT licenses.
The purpose of these copies is unclear. The tool may switch between them based on existing settings from Codex, Claude, or Cursor, but the mechanism is not obvious.
Upload remnants
Code for uploading to a GCS bucket remains in xai-grok-shell/src/upload/gcs.rs. The upload/trace.rs file includes an upload_session_state() function that returns a hard-coded session_state_upload_unavailable error.
Scale
For comparison, the OpenAI Codex repository contains 950,933 lines of Rust. Terminal coding agents are more complex than anticipated.
