An investigation by Cereblab, a company that analyzes AI security, found that SpaceXAI's AI coding support tool 'Grok Build' (version 0.2.93) transmitted authentication information and other sensitive data without being redacted. Cereblab set up fake tracking data and recorded communications, revealing that API keys and passwords read by Grok were included unprocessed in communications used for inference, and the same strings were recorded in other communications storing session information. Even when instructed to 'just say OK without reading the files,' Grok Build uploaded a 'Git bundle' containing the entire Git repository, allowing recovery of strings and commit history from unread files. In an experiment using a repository of approximately 11.2 GiB, at least 5.10 GiB in total was sent before the communication log was stopped, while the amount of data used for AI inference was approximately 192 KiB. The submitted data was stored in a bucket called 'grok-code-session-traces' on Google Cloud Storage. Disabling the 'Use for model improvement' setting in Grok did not stop the repository upload.