A new controversy has emerged around xAI's Grok Build coding tool after a security researcher claimed it was uploading users' entire code repositories to xAI's cloud without clearly informing them. Software security expert Hari posted on X that he reversed xAI's official Grok Build binary and that in a controlled session with zero tool-calls, it uploaded the complete codebase to xAI's storage, calling it a "malware-like background code collector." OpenAI CEO Sam Altman replied with "concerning." xAI responded publicly, stating it takes user privacy seriously and that enterprise customers using Zero Data Retention (ZDR) never have their code or trace data stored. According to The Hacker News, Grok Build was uploading entire Git repositories, including full commit history, to a Google Cloud Storage bucket operated by xAI. Researcher cereblab tested Grok Build version 0.2.93 and intercepted an upload that allowed recreation of the uploaded Git repository, which included a file Grok had been instructed not to read. In one test using a 12 GB repository, the AI model exchanged about 192 KB of data while answering the request, but the separate storage upload transferred 5.10 GiB of repository data, nearly 27,800 times more data than needed. A planted test file called never_read_canary.txt, which Grok Build never read, was found inside the uploaded repository along with the complete Git commit history. The investigation also found that if Grok opened