Independent AI safety checker cereblab conducted a wire-level analysis of xAI's official Grok Build CLI (grok 0.2.93). Through actual measurements using mitmproxy in a macOS environment, three critical behaviors were confirmed during normal use.
xAI's Grok Build CLI Uploads Code; Wire-Level Analysis Identifies Destination
This article is a translation. Read the Japanese original
Specifically, the tool performs codebase uploads, transmits session traces, and tracks file access information. It was proven that this data is sent to and accepted/stored in a Google Cloud Storage (GCS) bucket named "grok-code-session-traces." Whether this data is used for training is a matter of policy; this analysis specifically proves the facts of transmission and storage.
xAI subsequently added a server-side setting to disable uploads (disable_codebase_upload: true). Additionally, they introduced an opt-out feature via /privacy, though it has been confirmed that this is a data retention setting rather than a block on transmission. Elon Musk has previously pledged to delete previously uploaded data, but confirmation of completion has not yet been made.
Source: What xAI's Grok build CLI sends to xAI: A wire-level analysis（HN 539pt・229 comments） (HN Search (backfill), 2026-07-12)