xAI’s Grok Build has come under fire from developers who say the coding tool may upload local data to the cloud without adequately limiting what gets sent.
On July 13, 2026, developer A Green Being (@a_green_being) wrote on X that after accidentally running the tool from his home directory, “Grok has uploaded my entire user directory to xAI’s servers. It contains my SSH keys, my password manager database, my documents, photos, videos, everything.”
Log screenshot pointed to the user’s home directory
According to the unified.json log screenshot shared by the user, the system triggered multiple repo_state.upload.start requests, and the upload path pointed directly to the home directory at /home/usuario. Based on the screenshot cited in the report, the uploads covered files stored across that local directory.
The X post said: “Okay, grok has uploaded my entire user directory to xAI’s servers. It contains my SSH keys, my password manager database, my documents, photos, videos, everything.”
Earlier warnings mentioned repositories, Git history and .env files
The post from A Green Being came in response to a prior warning from CyberSatoshi (@XBToshi), who had said Grok Build was quietly uploading entire repositories, Git history and hidden .env files that can contain API keys and other secrets. CyberSatoshi said that data was being sent to Google Cloud Platform, or GCP.
CyberSatoshi had urged developers to inspect local Grok logs to check for possible data exposure. After A Green Being described what happened, CyberSatoshi replied, “You had it worse than me, you ran Grok in your home directory.”
Report urged developers to avoid running the tool from root or home directories
The incident has renewed attention on permission boundaries and data collection practices in AI-assisted development tools. The source report said tools of this kind can create serious security problems if they do not properly exclude files such as those covered by .gitignore or system hidden files.
The report recommended avoiding the use of Grok Build and similar tools from a root directory or a home directory. It also pointed to using isolated sandboxes, Docker containers or restricted user accounts, and cited a command for checking upload activity in Grok logs: cat ~/.grok/logs/unified.json | grep repo_state.upload.