Grok Build AI 编程工具被曝上传用户完整代码库至谷歌云

The Verge:AI(RSS)·2026-07-15 03:25·47天前·Stevie Bonifield
AI 导读

SpaceXAI 的 Grok Build AI 编程工具被曝在用户不知情时将完整代码库上传至 Google Cloud。安全机构 Cereblab 周一发布报告称,Grok Build CLI 会打包并上传整个代码仓库,包括被指示不要打开的文件以及从历史记录中删除的密钥,数据留存范围远超 Claude Code 等同类工具。研究人员测试显示,SpaceXAI 服务器已返回 disable_codebase_upload: true 标志,代码库上传功能已停止触发。

The Verge:AI(RSS)
61AI 编辑部评分,满分 100

Grok Build AI 编程工具被曝上传用户完整代码库至谷歌云

2026-07-15 03:25· 47天前· Stevie Bonifield
AI 导读

SpaceXAI 的 Grok Build AI 编程工具被曝在用户不知情时将完整代码库上传至 Google Cloud。安全机构 Cereblab 周一发布报告称,Grok Build CLI 会打包并上传整个代码仓库,包括被指示不要打开的文件以及从历史记录中删除的密钥,数据留存范围远超 Claude Code 等同类工具。研究人员测试显示,SpaceXAI 服务器已返回 disable_codebase_upload: true 标志,代码库上传功能已停止触发。

Elon Musk says that all previously uploaded data will be deleted.

Elon Musk says that all previously uploaded data will be deleted.

STK262_GROK_B_B STK262_GROK_B_B Stevie Bonifield

SpaceXAI’s Grok Build AI coding tool was spotted uploading users’ entire codebases to Google Cloud before it was reported, and the company turned it off. The Register reports that Cereblab published findings on Monday showing how the Grok Build CLI was packaging and uploading entire code repositories, “including files it was told not to open and secrets deleted from history,” significantly more data retention than similar tools like Claude Code.

The researchers say that as of Monday, their tests show SpaceXAI’s servers returning a “disable_codebase_upload: true” flag, and the codebase upload “no longer fires.”

Elon Musk responded to the incident in a post on X claiming that all data Grok Build previously uploaded will be “completely and utterly deleted.” Musk also said in a separate post that “privacy settings are always respected,” but asked users to allow SpaceXAI to retain their data, saying it’s “helpful for debugging issues.”

Dr. Lukasz Olejnik, an independent security researcher at King’s College London, confirmed to The Verge that this amount of data retention is “excessive,” adding that the data potentially at risk could include “proprietary source code, information about security vulnerabilities, personal data, infrastructure details, [and] credentials.”

SpaceXAI initially responded to the issue with a post saying that, “If [zero data retention] is disabled, the /privacy command is available in the CLI to disable data retention, which also deletes previously synced data.” However, Cereblab points out that “/privacy is a per-session retention toggle, not the switch that fixed this, so it shouldn’t be pointed to as the control.”

  1. Dave Eggers told OpenAI staff that ChatGPT was ‘silencing an entire generation’
  2. The PS6 sure sounds like a handheld
  3. Sony’s flagship RGB LED TV is incredible
  4. The FBI reportedly won’t investigate ICE anymore
  5. Kodak EC35 is a dirt-cheap point-and-shoot film camera

More in AI

Dave Eggers told OpenAI staff  that ChatGPT was ‘silencing an entire generation’ The apps, gadgets, and tools every reader needs TikTok is testing an AI likeness detection tool Apple’s plot to crush OpenAI New York governor says she’s using AI to analyze ‘every single rule’ in the state Google is renaming NotebookLM to Gemini Notebook Dave Eggers told OpenAI staff  that ChatGPT was ‘silencing an entire generation’ Dave Eggers told OpenAI staff  that ChatGPT was ‘silencing an entire generation’ The apps, gadgets, and tools every reader needs The apps, gadgets, and tools every reader needs TikTok is testing an AI likeness detection tool TikTok is testing an AI likeness detection tool Apple’s plot to crush OpenAI Apple’s plot to crush OpenAI New York governor says she’s using AI to analyze ‘every single rule’ in the state New York governor says she’s using AI to analyze ‘every single rule’ in the state Google is renaming NotebookLM to Gemini Notebook Google is renaming NotebookLM to Gemini Notebook

来源:The Verge:AI(RSS)· theverge.com