xAI open-sources Grok Build coding agent after it was caught exfiltrating repos to a cloud bucket

xAI has open-sourced Grok Build, its terminal-based AI coding agent, under an Apache 2.0 license — a move directly prompted by a security disclosure. A researcher discovered the tool was silently uploading entire developer repositories, including sensitive material like SSH keys, to a Google Cloud storage bucket without user consent or documentation. xAI patched the undocumented data-exfiltration behavior and released the source code to restore transparency and rebuild trust.

The incident is a notable entry in a week heavy with AI-security stories — arriving alongside Hugging Face's autonomous-attack disclosure and researchers demonstrating LLM-assisted exploit discovery. It highlights the specific risk of coding agents that operate with broad filesystem access: an agent that reads a whole repo to provide context is one configuration change away from exfiltrating it. Open-sourcing lets the community audit exactly what the agent sends where.

The timing coincides with other xAI momentum — Elon Musk announced 'Grok for Excel is now live' on July 20 (12,000+ likes), and the xAI roadmap continues to generate speculation about Grok 4.6. Open-sourcing under Apache 2.0 also aligns xAI, at least for this tool, with the open-weights momentum dominating the week.

Caveats: open-sourcing after a breach is partly damage control, and it doesn't undo data that may already have been collected. The severity depends on how many users ran the affected version and what was uploaded. Readers should watch for xAI's disclosure of scope (how many repos, what was retained), community audits of the released code, and whether other vendors' coding agents face similar scrutiny of their context-gathering behavior.