SpaceXAI Open-Sources Grok Build After Users Found it Secretly Uploaded Their Codebases

SpaceXAI has made Grok Build’s coding-agent harness publicly auditable under Apache 2.0 on July 15. Grok Build’s harness gathers context, interprets model responses, and dispatches tools through a terminal user interface. Opening the code followed a Grok Build repository-upload incident, in which version 0.2.93 secretly transmitted complete Git bundles, portable packages of repository files and commit histories, to an xAI-controlled storage bucket. 

SpaceXAI also reset usage limits after attributing unusually fast depletion to caching inefficiencies. It previously reset beta limits after caching improvements on May 26, making the new reset a separate action rather than part of the code license.

Public repository history appears to have contained one initial release commit when checked on July 16. Developers can inspect the current implementation, but that snapshot cannot reveal how SpaceXAI introduced, reviewed, or changed the upload path during private development.

SpaceXAI disabled the secret repository uploads after changing the default on July 12. Two server-side flags then changed, and six July 13 retests produced no storage uploads.

SpaceXAI CEO  Elon Musk committed to deleting the data, but completion still requires independent confirmation.

What the Open Code Lets Developers Control

SpaceXAI publishes its coding-agent harness and terminal interface in the Grok Build repository. Its agent loop assembles context and handles model responses. Adjacent components execute commands, render the terminal, review plans, and display inline code differences.

Interactive and headless modes let developers work in a terminal or invoke the same tool layer through scripts and bots. Model Context Protocol servers, which use a standard for connecting agents to tools and data, join skills, plugins, hooks, and subagents in extending the harness. SpaceXAI has presented Grok 4.5 for coding-agent workflows, while the open harness makes one layer around the still-closed model inspectable.

Developers who compile Grok Build can select a model endpoint through a local configuration file instead of relying only on SpaceXAI’s hosted inference. Both interactive and automated routes expose the same dispatch logic for inspection. Teams can examine which commands the agent invokes, how it assembles workspace context, and which external services receive requests.

Local compilation does not make every setup private by itself. Data handling still depends on the chosen endpoint, enabled tools, network settings, and installed extensions. Interactive mode keeps a person in the terminal for plan review and inline code differences, while headless mode lets scripts or bots invoke the tool layer without that continuous interface.

Claude Code’s subagents and Model Context Protocol integrations illustrate how comparable extension systems can broaden an agent’s access beyond its core runtime. Operators will still need to review permissions, network access, and the directories exposed to each Grok Build plugin, hook, or Model Context Protocol server.

First-party modules use Apache 2.0, while third-party components retain their licenses. Simon Willison’s count suggests the codebase includes 844,530 lines of Rust excluding whitespace and comments, with about 3% appearing to be vendored code.

Developers can now inspect, compile, and adapt the published material, but the repository does not accept outside contributions. SpaceXAI directs vulnerability reports to its HackerOne program rather than accepting community patches. This means that SpaceXAI still retains control over merged fixes and future changes.

The Upload Mechanism and Open-Source Alternatives

A Grok Build user posting as @a_green_being had discovered that running the tool in a home directory uploaded Secure Shell keys and personal files, including a password-manager database, documents, photos, and videos. The listed files illustrate what can be exposed when a coding agent scans the wrong directory.

The 12 GB proxy run of version 0.2.93 sent the transfer in 73 chunks. Model-turn traffic totaled about 192 KB, while a separate storage channel carried 5.10 GiB. Turning off model improvement did not stop the repository uploads because training consent and code transmission used separate controls.

Published code for Grok Code still contains Google Cloud Storage plumbing, although the upload function now returns a hard-coded unavailable error. Developers can audit that current state, but the one-commit history does not reconstruct the private code that produced the earlier behavior.

OpenCode, Aider, and Cline give developers three shipping open-source alternatives for comparing model choice, local operation, extension design, contribution rules, and observable data paths. SpaceXAI’s $60 billion acquisition of Cursor also ties its coding-agent push to a previously rival development platform. 

Future commits and independent transmission tests can clarify whether the current safeguards introduced in Grok Build will endure. As independent confirmation most probably will not be made available for whether SpaceXAI deleted coding data collected before uploads were disabled, users of Grok Build will just have to trust Elon Musk’s promise.