cereblab
A security researcher who drew attention for discovering, through packet-capture testing, that Grok Build CLI was covertly uploading git repository data.
Timeline (last 90 days)
xAI's Grok Build CLI 0.2.93, after receiving only an "OK" reply and without reading any files, still pushed a complete git bundle containing 4 commits and 47 files to xAI's storage endpoint.
In a test with a repository of about 12GB of random files, about 192KB flowed to the model channel while about 5.10GiB flowed to the storage channel, split into 73 chunks of about 75MB each.
After turning off the "Improve the model" privacy switch, the git bundle upload still succeeded with HTTP 200, and the server's /v1/settings response still carried trace_upload_enabled: true; this switch controls training, not uploading.
In a real task where the agent actually read files, the contents of a git-tracked .env file entered the model conversation turns, and the same batch of values also landed in the session_state archive being prepared for sending to storage.
On July 13, 2025, the same Grok Build CLI version 0.2.93 suddenly stopped storage requests; six retests all showed zero /v1/storage uploads, and the server returned disable_codebase_upload: true and trace_upload_enabled: false.
After testing the /privacy function, cereblab concluded: it controls data retention, not what data is sent.
A deny rule like Read(secret.txt) can prevent the agent from reading the file, but the file tracked by git still exists in the uploaded git bundle.
On July 13, 2025, the same canary repository was used for testing: Claude Code 2.1.204 only sent POST api.anthropic.com/v1/messages; Codex sent model conversations to chatgpt.com via WebSocket along with telemetry; Gemini 0.38.2 ran idle in API-key mode with no bundle, and a real task hit a 429 quota error. None of the three uploaded a repository bundle.
A server-delivered toggle can be flipped back by the server at any time, no new binary will appear on the machine, and there will be no record in the changelog; therefore, security audits of agent CLIs must be repeatable and incorporated into the CLI upgrade process rather than being one-off forensic conclusions.
All Facts (9)
A deny rule like Read(secret.txt) can prevent the agent from reading the file, but the file tracked by git still exists in the uploaded git bundle.
50%UnverifiedOn July 13, 2025, the same canary repository was used for testing: Claude Code 2.1.204 only sent POST api.anthropic.com/v1/messages; Codex sent model conversations to chatgpt.com via WebSocket along with telemetry; Gemini 0.38.2 ran idle in API-key mode with no bundle, and a real task hit a 429 quota error. None of the three uploaded a repository bundle.
50%UnverifiedA server-delivered toggle can be flipped back by the server at any time, no new binary will appear on the machine, and there will be no record in the changelog; therefore, security audits of agent CLIs must be repeatable and incorporated into the CLI upgrade process rather than being one-off forensic conclusions.
50%UnverifiedIn a test with a repository of about 12GB of random files, about 192KB flowed to the model channel while about 5.10GiB flowed to the storage channel, split into 73 chunks of about 75MB each.
50%UnverifiedAfter turning off the "Improve the model" privacy switch, the git bundle upload still succeeded with HTTP 200, and the server's /v1/settings response still carried trace_upload_enabled: true; this switch controls training, not uploading.
50%UnverifiedAfter testing the /privacy function, cereblab concluded: it controls data retention, not what data is sent.
50%UnverifiedOn July 13, 2025, the same Grok Build CLI version 0.2.93 suddenly stopped storage requests; six retests all showed zero /v1/storage uploads, and the server returned disable_codebase_upload: true and trace_upload_enabled: false.
50%UnverifiedIn a real task where the agent actually read files, the contents of a git-tracked .env file entered the model conversation turns, and the same batch of values also landed in the session_state archive being prepared for sending to storage.
50%UnverifiedxAI's Grok Build CLI 0.2.93, after receiving only an "OK" reply and without reading any files, still pushed a complete git bundle containing 4 commits and 47 files to xAI's storage endpoint.
50%