Anecdote◆Article
Running xAI's grok CLI tool in a directory could silently upload that entire directory—including sensitive files like SSH keys and password manager databases—to xAI's Google Cloud buckets.
xAI's grok CLI was found to upload entire directories, including highly sensitive files, to xAI's cloud storage, sparking severe community backlash. ✦ AI generated
Simon Willison · Simon Willison's Weblog · 2026-07-15 · original ↗
xAI's grok CLI tool had severe community backlash yesterday when it became apparent that running the command in a directory could upload that entire directory to xAI's Google Cloud buckets. One user reported running it in their home directory and seeing it upload "my SSH keys, my password manager database, my documents, photos, videos, everything".
Read full article ↗excerpt · fair-use quotation
- ·Running grok CLI could upload whole directory to xAI cloud
- ·Uploads went to xAI's Google Cloud buckets
- ·Triggered severe community backlash
- ·No explicit user consent for upload
- ·One user's home directory fully uploaded
- ·SSH keys included in upload
- ·Password manager database included
- ·Documents, photos, and videos included
Around this claim
This moment responds to
provides context → All user data that xAI had uploaded prior to this point will be completely and utterly deleted, as a precautionary measure.Elon Musk · Simon Willison's Weblogprovides context → xAI's decision to open-source the entire Grok Build codebase under Apache 2.0 just hours after the backlash was presumably an attempt to regain user trust.Simon Willison · Simon Willison's Weblogprovides context → By deleting all retained data, turning off retention by default, and open-sourcing the harness, xAI now offers complete user privacy, including the option to run Grok Build fully local with your own inference.xAI · Simon Willison's Weblogextends → Grok build CLI was silently uploading entire private Git repositories (including unredacted secrets) to a Google Cloud bucket, transferring far more data than the coding task required.Scott Tolinski · Syntax