Grok Build CLI

Overview

Grok Build CLI is xai/spacexai’s terminal coding agent. Wire analysis of v0.2.93 (July 2026) found undisclosed full-repository uploads to xAI cloud storage; on July 15 the Rust harness was open-sourced under Apache 2.0 for audit and local-first runs.

Recent Developments

• 2026-07-15: Full Rust harness/TUI/tools/extensions open-sourced under Apache 2.0; local-first via config.toml; external PRs not accepted (2026-07-16-spacexai-grok-build-open-source)

Security Findings (July 2026)

Researcher cereblab documented two data channels (2026-07-12-grok-build-cereblab-gist-primary):

1. Model-turn channel: Files read by agent sent via POST /v1/responses — includes unredacted .env secrets
2. Storage channel: Entire workspace uploaded as git bundle via POST /v1/storage to grok-code-session-traces GCS bucket — independent of agent reads

Key metrics: 5.10 GiB transferred on 12 GB test repo; ~27,800× storage vs model channel ratio. “Improve the model” toggle does not disable uploads (trace_upload_enabled: true). Binary embeds xai-data-collector Rust crate.

Analysis proves transmission and storage, not whether xAI trains on uploaded data. No xAI public response documented as of July 12, 2026.

Related

• model-context-protocol
• apache-2.0
• xai
• grok
• spacexai
• ai-coding-tools
• data-privacy
• coding-agents
• ai-security
• spacexai-grok-build-open-source

Sources

• 2026-07-12-grok-build-cli-repo-upload-security
• 2026-07-12-grok-build-lavx-news
• 2026-07-12-grok-build-cereblab-gist-primary
• 2026-07-16-spacexai-grok-build-open-source
• spacexai-grok-build-open-source