The timing tells you everything. July 12: a researcher showed Grok Build’s CLI was packaging entire tracked repos — full Git history, committed secrets — off to a Google Cloud bucket, roughly 27,800x more data than the coding task needed. One user watched it upload SSH keys, a password vault, photos. The “Improve the model” toggle did nothing. HN: 549 points, 580 comments. Three days later xAI dumped the whole thing on GitHub under Apache 2.0.
What you actually get
Grok Build is the coding agent harness behind the grok CLI — a fullscreen, mouse-driven Rust TUI that reads your codebase, edits files, runs shell commands, searches the web. 844,530 lines (Codex is 950,933, for scale). 10.8k stars, 1.8k forks already. Extensible through skills, plugins, hooks, MCP servers and subagents, all driven by config.toml.
The API angle
Headless mode for CI scripting. Agent Client Protocol to embed it in an editor. And you can compile it yourself and point it at local inference — which is the entire point now.
The catch
The GCS upload code is still in there. upload_session_state() just returns a hard-coded session_state_upload_unavailable error. Disabled, not deleted. xAI also refuses external PRs — this is a mirror, not a community project. Open source as damage control still beats a black box. Read it before you trust it.
You Might Also Like
- Agent Skills Addy Osmani hit 8600 Github Stars by Forcing Coding Agents to act Like Senior Engineers
- Grok Build cli Caught Uploading Entire Repos Even Home Directories to xai Servers
- Proofshot Adds Visual Verification to ai Coding Agents no mcp Server Required
- Xai Ships Grok Connectors With 8 Integrations and byo mcp Support
- Cloudrouter Gives Your ai Coding Agent its own Cloud Machine and Thats a big Deal
Top AI Product 
Leave a comment