Grok CLI Unauthorized Codebase Upload Analysis

The Exfiltration Mechanism

Security research using MITM proxy revealed that the Grok CLI automatically bundled and uploaded entire local repositories to xAI servers. This behavior occurred even when users explicitly prompted the model to not open any files. Unlike other coding assistants such as Claude Code, Codex, or Gemini, which only transmit the specific files required for the current context, the Grok CLI sent the full directory, including sensitive Git history and environment variables. The tool relied on a hardcoded flag, trace_upload_enable, which remained set to true even when users opted out of model improvement settings.

Privacy Controls and Server-Side Logic

Following public disclosure, xAI implemented a server-side kill switch and introduced a /privacy command in the CLI. However, technical analysis indicates that this command does not prevent data transmission from the client. Instead, it merely toggles a server-side flag, coding_data_retention_optout. When the privacy mode is enabled, the client still transmits the data, but the server returns a 204 status code to indicate the data was discarded rather than stored. This requires users to trust that the server-side logic is functioning as intended, as the local binary still contains the code responsible for the repository upload. Furthermore, the privacy setting appears to be session-specific, potentially requiring users to re-enable it for every new session.