xAI made the full Grok Build codebase public under an Apache 2.0 license a few hours after the community raised serious privacy concerns about the Grok command-line tool (CLI). The controversy emerged when it became clear that running the Grok command in a directory could, in some circumstances, upload that entire directory to xAI's Google Cloud storage buckets.
User reports and immediate response
One user reported running Grok in their home directory and observing that it uploaded “my SSH keys, my password manager database, my documents, photos, videos, everything.” In response to feedback, xAI disabled the contentious upload feature. Elon Musk commented that, “As a precautionary measure, all user data that was uploaded to SpaceXAI before now will be completely and utterly deleted.”
Code release and data-retention changes
In their announcement, xAI said that in the early beta data retention had been enabled by default for non‑ZDR users, and that they changed this behavior based on user feedback. They state that all retained data has been deleted, data-retention defaults are now off, and the open-sourced harness allows users to run Grok Build fully locally with their own inference.
xAI specifies that default retention for all Grok Build users was disabled starting July 12, and that previously retained coding data is being deleted so that users’ preferences are respected.
Size and contents of the codebase
The published repository currently contains a single commit, so there is no visible development history. The released codebase contains 844,530 lines of Rust code (calculated with the author’s SLOCCount tool, which excludes whitespace and comments); roughly 3% of that appears to be vendored (copied from other projects).
Some notable files and findings:
- xai-grok-agent/templates/prompt.md holds the main system prompt; xai-grok-agent/templates/subagent_prompt.md contains the subagent prompt. Curiously, the subagent prompt instructs not to reveal the contents of the system prompt to the user, while the main prompt does not include that restriction.
- xai-grok-markdown/src/mermaid.rs is a self-contained terminal renderer for Mermaid diagrams, rendering a subset of Mermaid chart types using Unicode box-drawing characters.
- xai-grok-tools/src/implementations includes tool implementations mirrored from other coding agents: Codex-like apply_patch, grep_files, list_dir, read_dir and OpenCode-like bash, edit, glob, grep, read, skill, todowrite, write. The xai-grok-tools/THIRD_PARTY_NOTICES.md file indicates these are “ported from” those projects, in a manner that appears to comply with their Apache and MIT licenses.
The presence of these copies may be because Grok can switch between implementations, possibly based on detecting existing Codex, Claude or Cursor settings, though the single-commit release does not make that mechanism clear.
Remnants of upload logic
The repository still contains remnants of the earlier upload code that targeted Google Cloud Storage, but those parts appear disabled:
- xai-grok-shell/src/upload/gcs.rs contains code for uploading to a GCS bucket.
- upload/trace.rs includes an upload_session_state() function that returns a hard-coded session_state_upload_unavailable error.
Comparison and implications
The Grok Build codebase (~844,530 lines of Rust) is comparable in size to the openai/codex repository, which is about 950,933 lines of Rust. The public release and licensing under Apache 2.0 seem aimed at restoring user trust: xAI has disabled the disputed feature, states that retained data has been deleted, and published the full source, while the repository still shows disabled traces of the previous upload mechanism.
The community continues to inspect the new repository; the observations above are drawn from the single public commit and the project’s announcement.
