Security researchers have found that xAI's Grok Build CLI 0.2.93 uploads the entire Git repository to the cloud, including all trace files, commit history, and sensitive keys. Tests have shown that even if Grok is required not to read files, it will still upload bait files. When testing the 12GB warehouse, 5.5GB of data had already been successfully uploaded before the suspension. If Grok reads the. env file, the API key and database password will enter the model request and session archive. After closing Improve the model, the whole warehouse upload will still continue.
