Security researchers at CereLab found that xAI's Grok Build CLI coding tool uploaded entire Git repositories instead of only the files needed for coding tasks, transmitting more repository data than the model required. In one test, a 12GB repository resulted in around 5.1GB of uploaded data, while the coding task required only about 192KB. The analysis identified potential exposure of files such as .env configurations, credentials and Git history. After the findings were published by Bluepoint, CereLab reported that Grok Build's servers returned the setting `disable_codebase_upload: true`, indicating repository uploads had been disabled remotely via a server‑side change. Because Grok Build is a closed‑source tool, outside researchers cannot inspect the underlying code. xAI later responded by highlighting privacy settings, stating that teams using Zero Data Retention (ZDR) would not have code data retained and pointing users to the `/privacy` command in the CLI. xAI said, "We care deeply about your privacy and respect customer choice." ZDR is only available to enterprise accounts, according to xAI's documentation.