SpaceXAI turns off Grok Build code uploads after researchers flag issue

In short: Researchers say SpaceXAI’s Grok Build tool was uploading users’ full software projects to Google Cloud, and SpaceXAI has now turned that upload off.

What happened

Researchers at Cereblab reported that Grok Build, an AI coding tool from SpaceXAI, was packaging and uploading entire code repositories to Google Cloud. A code repository is like the main folder that holds a software project, including many files and past changes.

According to The Register, the researchers said the uploads could include files Grok Build was told not to open. They also said it could include “secrets” that had been deleted from a project’s history, like old passwords or private keys that should not be shared.

Cereblab’s tests showed that, as of Monday, SpaceXAI’s servers were sending a setting that effectively disables this behavior. They said the “codebase upload” no longer runs.

Elon Musk responded on X, saying any data previously uploaded by Grok Build will be “completely and utterly deleted.” In another post, Musk said “privacy settings are always respected,” but he asked users to allow SpaceXAI to keep data because it can help fix bugs.

An independent security researcher, Dr. Lukasz Olejnik of King’s College London, told The Verge that this level of data collection is “excessive.” He said the data at risk could include private source code, details about security weaknesses, personal data, and login credentials.

Why it matters

When you use an AI tool that reads your code, you are often giving it access to a company’s internal work, like handing a contractor the keys to the office. If the tool uploads more than you expect, it can expose sensitive information and create security and privacy risks.

Source: The Verge AI