The tool, Grok Build, is very similar to, for example, the hugely popular Anthropic's Claude Code or OpenAI's Codex, meaning it is a comprehensive AI-assisted software development solution.
But cybersecurity company Cereblab made a very concerning discovery about Grok Build when the company investigated what various AI-assisted programmer tools actually do.
While all other tools send only the source code files that need to be modified with the help of AI to the software development company's server, Grok Build operated very differently.
Grok Build, in fact, sent the entire software project with its source codes, i.e., the so-called repository, to SpaceXAI's servers.
The action was also not an accident, as Cereblab tried to modify Grok Build's prompt to explicitly instruct it to send only the files it needed for modification along with the prompt. Despite this, Grok Build sent absolutely all project-related files (the entire repo) to SpaceXAI.
Thus, all company secrets, potential API keys (if they were foolishly stored as part of the repository), and potential business secrets, for example, regarding documentation - and indeed the entire program code as a whole - were transferred.
After being caught, SpaceXAI apologized for the situation and promised (link leads to Twitter/X) to delete all collected data from its servers. Elon Musk himself also hastened to assure (Twitter/X) that all data collected from customers would be immediately destroyed.
SpaceXAI advised its customers to use the /privacy option in the future, which ensures that data is not stored on the company's servers. Cereblab criticized the recommendation, as Grok Build does not allow permanently turning off data collection; instead, this option must be added every time the tool is used.
Written by: Petteri Pyyny @ 16 Jul 2026 4:22
