xAI's Coding Tool Was Quietly Uploading People's Files. Here's the Lesson.
Users found that xAI's 'Grok Build' coding agent uploaded entire folders, including passwords and keys, to the company's servers. xAI turned the feature off and open-sourced the code. A useful reminder to check what your AI tools actually do.
xAI’s new coding tool, Grok Build, ran into trouble this week after users discovered it was quietly sending their files to the company’s servers. One user reported that SSH keys, a password database, documents, and photos had all been uploaded. Not exactly what you expect from a tool you pointed at your own folder.
To translate the jargon: Grok Build is a “coding agent,” a program you run in your terminal that can read and edit your code, run commands, and search the web to help you build software. The problem was that it uploaded everything in a directory, not just the code it needed, to xAI’s cloud. After the complaints, Elon Musk said all uploaded user data would be fully deleted, xAI disabled the upload feature, and the company published the tool’s full source code on GitHub under an open license so anyone can inspect what it does. xAI says data storage has been switched off by default since July 12. Some leftover pieces of the upload code reportedly still exist in the codebase, but disabled.
The move to open-source the tool is really an attempt to rebuild trust. When a program runs on your machine with access to your files, you’re taking the company’s word for what it does with them. Publishing the code lets outside developers actually check, which is a stronger promise than “trust us.” It’s also a reminder that “AI agent” means “software that can act on your computer,” and access to your files is exactly what makes these tools powerful and risky at the same time.
What this means for you: You don’t need to code to take the lesson. Before you give any AI tool access to your files, folders, email, or accounts, it’s worth pausing to ask what it can reach and where that data goes. That’s doubly true for anything that runs on your own computer with broad permissions. A fair, non-scary way to think about it: an AI agent is like handing someone your keys to get one job done, handy, but you’d want to know which rooms they can walk into. If you do use developer tools, keep sensitive things like keys and password files out of any folder you point an agent at.
Sources
Google Search Will Now Make Up an Image When It Can't Find One
Google is adding AI image generation to Search: when no matching picture exists on the web, you can type a prompt and it creates one. Powered by a fast, cheaper 'Nano Banana 2 Lite' model. What it means for you, and for the web.
