xAI leaks SSH keys, uploads data — and responds by open-sourcing Grok-Build
xAI released the 844,530-line Rust source code for Grok Build after the agent was found to upload sensitive files like SSH keys and passwords to its cloud servers.
Facing backlash for security risks, xAI has open-sourced its Grok Build agent on GitHub under the Apache 2.0 license after users discovered the terminal tool uploaded entire directories, including SSH keys and passwords, to Google Cloud. The 844,530-line Rust codebase, which includes the agent loop, tools, and terminal UI, now supports local-only execution and has the data upload feature disabled by default. This transparency effort allows developers to audit the code and run the agent locally, mitigating fears of data exfiltration. The incident highlights the security risks inherent in AI coding agents that require broad file system access.