I investigate AI, and publish what I find.

Grok's coding CLI uploaded your whole repo — and your git history.

It packaged the entire repository — including files it was told not to open and secrets deleted from history — into a git bundle and shipped it to Google Cloud Storage. I captured it on the wire and cloned it back. As of 2026-07-13 xAI's server returns disable_codebase_upload: true and it no longer fires. Its new /privacy opt-out changes what xAI retains, not what leaves your machine — see the timeline below.

The investigation

1. Route its traffic through me
   mitmproxy + a locally-trusted CA; HTTPS_PROXY → every request Grok makes is logged.
2. Tell it to do nothing
   prompt: "reply OK, do not open any files." Nothing should leave the machine.
3. It uploaded anyway
   POST /v1/storage → 200, body magic # v2 git bundle. A whole-repo bundle, on an idle prompt.
4. Clone the captured bytes
   git clone of the wire body reconstructed the repo — including the file marked never-read, verbatim.
5. Measure the blast radius
   full git history rode along — secrets deleted months ago were still in the bundle; read .env went to /v1/responses.
6. Try to opt out
   turned off "Improve the model" — /v1/settings still returned trace_upload_enabled: true; the upload still fired.
7. Prove it's not a fluke
   reproduced on a second, unrelated codebase; other researchers confirmed on their own private repos (269 blobs · 219 MB).
8. The walk-back
   2026-07-13: same client, but /v1/settings now returns trace_upload_enabled: false + disable_codebase_upload: true. Upload no longer fires. I can't prove I caused it — only the timeline.
9. The fix arrives
   xAI ships a /privacy opt-out command and defaults the codebase upload off. Retested on grok 0.2.99 (binary SHA 01bcacec…).
10. I tested the opt-out
    A/B on the wire: opt-in vs opt-out send the same requests — session traces and model turns leave either way. The only change is /v1/traces returning 200 → 204.
11. Retention, not transmission
    /privacy sends PUT {"codingDataRetentionOptOut": true} — a server-side "don't keep it," not a block on what's sent. Your data still leaves the machine; the upload code still ships in the binary.