Recently, the AI coding tool Grok Build has been embroiled in a privacy scandal. According to foreign media reports, the tool was exposed for uploading users' code repository data without explicit authorization, causing great concern among developers worldwide. Faced with the escalating controversy, Elon Musk personally responded, promising to completely delete all historical user data.

The incident was triggered by a "phishing" test conducted by a security researcher. The researcher created a fake test repository, embedded unique markers, and monitored the data flow throughout. The results were shocking: even though users had turned off the "help improve the model" option, Grok Build silently packaged the entire repository and its modification history, transmitting it to a third-party bucket. The amount of data transmitted reached several GBs, including sensitive directories that may contain keys and configuration files.

image.png

This incident quickly caused panic within the developer community. Code repositories are the core assets of developers, and once leaked, they not only mean the loss of commercial secrets but also directly threaten the security of production environments. Many users changed all access keys overnight and even chose to uninstall the related tools to protect themselves.

In response to the accusations, the xAI team quickly took action, stopping the illegal upload behavior and officially launching a new feature aimed at protecting user privacy, allowing users to turn off data retention with one click and trace and delete uploaded data. In his response, Musk made a firm statement, saying "Zero anything whatsoever will remain" (not a single byte will remain), clearly indicating that all previously collected data would be thoroughly erased.

From developer doubts to official deletion, the entire crisis was resolved within 48 hours. Although the data has been promised to be deleted, this incident undoubtedly served as a warning to the Agentic Coding (agent-based coding) sector. As an AI assistant with the highest level of computer permissions, how to maintain the principle of "privacy first" while providing productivity has become an issue that all developer tool vendors must face head-on.