Breach analyses · 2026-07-12 · Developer tooling · Data exfiltration

Grok Build CLI uploaded developers' entire git repositories, secrets included, without disclosure.

An independent researcher's wire-level analysis found xAI's coding CLI sending complete tracked git repositories, full history and committed secrets, to a Google Cloud Storage bucket the tool never disclosed. The privacy toggle in the CLI's settings had no effect on the upload. A planted canary file told Grok not to read it; the file showed up in the captured bundle anyway.

Original source: Pragmatic Engineer, 2026-07-12

Facts of the incident

What we know.

Vendor / tool

xAI, Grok Build CLI

What was uploaded

Complete tracked git repository per session: full commit history, including committed secrets

Destination

A Google Cloud Storage bucket, undisclosed to users

Data-to-task ratio

~27,800x more data uploaded than the coding task required (researcher's wire-level measurement)

Privacy toggle

Present in the CLI's settings; measured to have no effect on the upload

Canary proof

A planted file instructing Grok not to read it appeared verbatim in the captured upload bundle

Publication

2026-07-12, independent security researcher, wire-level traffic analysis

xAI's response

Behavior disabled server-side 2026-07-13 (one day later); no software update; no formal security advisory; announced via social media

Data deletion

No published timeline; a public deletion promise from Musk came 2026-07-14, after the story reached the Hacker News front page

Comparable tools

Canary tests found Claude Code, Codex CLI, and Gemini CLI did not exhibit equivalent whole-repository uploads

Four-stage failure analysis

Where each stage would have been gated.

This is not a network breach in the usual sense. It is a trusted developer tool, granted broad local authority, using that authority for an action wildly out of proportion to the task, with no mechanism to see the egress, require authorization for it, or prove afterward what was sent. The pattern traversed four stages.

Broad local authority, granted by default

What happened: Grok Build CLI runs on a developer's machine with read access to whatever project directory it is pointed at. Developers install a coding assistant expecting it to read the files relevant to the prompt they gave it, not the full git history sitting alongside those files.

Governed tool-call gating via the SynOI Gateway + MCP proxy - SHIPPED for traffic routed through it

Every tool call an AI agent makes through a SynOI-governed path, a gateway install or the MCP proxy in front of a coding tool, mints a signed Decision Receipt and can be checked against a risk policy before it executes. An outbound transfer carrying roughly 27,800x more data than the coding task required, per the researcher's own measurement, is exactly the shape of anomaly a policy gate exists to catch: not by reading the code, but by comparing the size and destination of the action to what the task should need.

The wire-level analysis was published 2026-07-12 by an independent security researcher; see sources below.

Disproportionate, silent egress

What happened: The uploads were not confined to files relevant to the prompt. Wire-level analysis showed the client sending the complete tracked repository, committed secrets included, to a Google Cloud Storage bucket the tool never disclosed. A researcher's planted canary file, containing an explicit instruction not to read it, appeared verbatim inside the captured upload: proof the upload was indiscriminate, not task-scoped.

Risk policy + human-in-the-loop (HITL) approval on outbound data volume - SHIPPED for gateway-routed calls

A risk policy rule such as outbound payload exceeds N times the estimated task size fires a human approval request, by SMS, Slack, mobile push, or system tray, before the transfer completes. Moving 27,800x more data than a task needs is precisely the anomaly this class of policy exists to interrupt.

The same researcher's canary tests found Claude Code, Codex CLI, and Gemini CLI did not exhibit equivalent whole-repository uploads under the same test conditions.

A privacy toggle with no enforcement behind it

What happened: Grok Build CLI shipped a privacy toggle in its settings. Testing showed it had no effect on the upload: the behavior continued identically with the toggle on or off. A control surface existed; nothing was wired to it.

Policy bound at the point of dispatch (SynOI's decide() gate, active on gateway-routed calls) + @synoi/claude-guard for coding CLIs - BUILT, not yet published

SynOI's gate sits at the tool-call dispatch point itself, so a policy decision and the action it governs cannot drift apart the way a UI toggle and an upload path did here. The pre-execution hook that applies this same decide() policy directly to Claude Code and Cursor tool calls exists today as a built prototype; it has not been published for anyone else to install, and it does not target xAI's tooling. This incident was a closed-source CLI making direct network calls entirely outside any governed proxy. SynOI governs actions routed through it; it cannot reach into a vendor's client to bind a toggle that vendor never wired in the first place. That boundary is the point: egress governance needs to be a default property of the path an AI tool's calls travel, not an opt-in a vendor can leave disconnected.

xAI has not published a root-cause explanation of why the toggle had no effect.

Opaque incident response, no verifiable timeline

What happened: xAI disabled the behavior server-side on 2026-07-13, one day after the analysis published. There was no software update and no formal security advisory. The company's public response was social media. No data-deletion timeline was published; a public promise to delete the captured data came from Musk on 2026-07-14, after the story reached the Hacker News front page.

Signed Decision Receipts (SHIPPED for gateway-routed actions) + OTS/Rekor anchoring (planned)

Every action routed through a SynOI-governed path produces a hybrid-signed (Ed25519 + ML-DSA-65) receipt, counter-signed by SynOI's control plane. For a gateway-routed AI tool, show me each upload this tool made between these two dates returns a precise, signed answer today, not a promise made after a story trends. Anchoring receipts to Bitcoin (OpenTimestamps) and sigstore Rekor, for tamper-evidence beyond SynOI's own infrastructure, remains planned rather than shipped.

Compare to status quo here: a behavior change announced on social media, no advisory, and a deletion commitment made under public pressure rather than on a published schedule.

Editorial honesty

What we will and won't claim about this incident.

This analysis would be dishonest without stating the limits clearly. SynOI did not detect this incident; an independent researcher did, through wire-level analysis and a canary test, entirely outside SynOI.

We will claim

Governed tool-call gating with a signed receipt, shipped for traffic routed through the SynOI Gateway and its MCP proxy, is designed for exactly this shape of anomaly: an egress action carrying orders of magnitude more data than the task required
A policy bound at the point of dispatch cannot silently drift out of sync with a UI toggle the way this incident's privacy setting did
Signed Decision Receipts would answer "show me each upload this tool made in a specific window" with a precise, verifiable record, rather than a promise made under public pressure
The pre-execution hook for coding CLIs, @synoi/claude-guard, exists as a built prototype for Claude Code and Cursor today

We won't claim

That SynOI would have prevented this incident. Grok Build CLI's calls were not routed through any governed path; a closed-source CLI making direct network calls outside a governed proxy is outside what SynOI, or any similar gate, can reach
That @synoi/claude-guard, built but not yet published, would have caught this in production. It is not a released product, and it does not target xAI's tooling
That a privacy toggle failing silently is unique to xAI. Any UI control not wired to enforcement can fail this way; this is a general lesson, not a claim about one vendor's engineering
That SynOI replaces the researcher's own wire-level analysis, canary testing, or any other independent security research. Detection of this specific incident happened entirely outside SynOI

Why this matters to an engineering leader

Five reasons a build pipeline adopts egress governance.

Coding tools are a privileged read path

Developers are running at least one AI coding tool with filesystem access, and that footprint keeps expanding. Grok Build CLI is one example; it will not be the last. The question is not whether to grant that access, but whether the actions taken with it are bounded and visible.

A UI toggle is not a policy

A privacy setting that does not change the underlying request is not privacy, it is a placebo. Binding policy at the point of dispatch, where the tool call itself is issued, closes that gap by construction rather than by trust in a vendor's settings screen.

Egress ratio is a checkable signal

27,800x more data than a task requires is not a subtle anomaly. Comparing outbound payload size to task scope is a mechanical check, and it can run before data leaves the machine rather than after a researcher finds it on the wire.

Verifiable response beats a promise on social media

xAI's fix and its silence on a deletion timeline arrived through a post, not a security advisory. A signed receipt corpus answers what happened and when with evidence, not a public statement made after a story trends on Hacker News.

Authority to execute keeps arriving before authority to refuse

SynOI's starting premise is that tools get the authority to execute long before anyone builds the authority to refuse. Grok Build CLI's egress path, running for an unknown period before a researcher caught it on the wire, is what that gap looks like once it reaches production.

Sources

Corrections welcome.

If any fact above is wrong or has changed, tell us at /contact and we will fix it.

Want your build pipeline's egress checked?

Self-hosted on your hardware. Uses your existing AI provider keys. Route one coding tool through the SynOI Gateway in observe mode and see what its calls actually carry. Decision to add a policy is yours.

Start a pilot conversation Quickstart

Coding CLI, not a network proxy? See @synoi/guard (pre-release), the pre-execution hook for Claude Code and Cursor.