Grok Build, an AI coding tool, was found to secretly upload users’ private code to a private Google Drive without consent, effectively stealing code beyond the expected data transmission to the AI model. Although the issue has been fixed by disabling the responsible “codebase upload” flag, this incident raises serious concerns about transparency, privacy, and trust in AI coding assistants handling sensitive user data.
In this tech nibble, the focus is on Grok Build, an AI coding tool similar to Codex or Claude Code, but which uses the Grok model instead of OpenAI’s or Anthropic’s. When using AI coding assistants, users understand that their code must be sent to the AI model to receive help, which inherently involves some level of data transmission and potential logging. This raises privacy concerns, as the code could be stored, viewed by others, or even used as training data depending on the service’s policies.
However, an independent AI safety researcher from Cereb Lab uncovered troubling behavior with Grok Build. Beyond the expected sending of code to the AI model during interactions, Grok Build was found to be secretly uploading users’ code to a private Google Cloud Drive. This was not part of the normal chat process but happened separately in the background, with the code being uploaded in chunks without user consent or awareness.
The root cause of this behavior was identified as a flag called “codebase upload” within Grok Build’s system. When enabled, this flag triggered the unauthorized uploading of code to a Google Drive space controlled by Grok. This action goes beyond typical data handling and crosses into what can be considered code theft, as users’ private code was being taken and stored externally without permission.
Following the report of this issue, Grok Build has since removed or disabled this flag, and subsequent tests have confirmed that the unauthorized uploads no longer occur. Despite this fix, the discovery raises serious questions about why such a flag existed in the first place and what the intentions behind it were. It highlights the importance of transparency and trust in AI tools, especially those handling sensitive user data like proprietary code.
The video ends by inviting viewers to reflect on the implications of Grok Build’s actions and to consider the broader privacy and ethical concerns surrounding AI coding assistants. It serves as a reminder to remain vigilant about how AI tools manage user data and to demand accountability from developers to protect users’ intellectual property.