xAI open-sources Grok Build after it vacuumed up user SSH keys

You can’t make this stuff up. xAI’s coding agent Grok Build landed in a privacy firestorm after users discovered it was silently uploading entire directory contents—SSH keys, password databases, personal documents, photos, the works—to the company’s Google Cloud servers. One user flagged the breach, and the backlash was immediate. Elon Musk responded by pledging all uploaded data would be deleted, and the upload feature was swiftly disabled.

Now xAI is trying to rebuild trust the hard way: radical transparency. The company has published the full Grok Build source code on GitHub under the permissive Apache 2.0 license. That’s roughly 844,530 lines of Rust, spanning the agent loop, terminal UI, shell command execution, and an extension system for plugins and subagents. For developers who want zero ambiguity about where their data goes, the tool can now run entirely locally. No cloud dependency.

Grok Build itself is a terminal-based coding agent invoked with the grok command. It reads and edits codebases, runs shell commands, searches the web, and handles long-running tasks. It can operate interactively, headlessly for scripting and CI pipelines, or embedded in editors through the Agent Client Protocol. The architecture is genuinely flexible—which makes the upload debacle all the more frustrating, because the tool underneath the privacy landmine is actually interesting.

I’m of two minds here. Open-sourcing is the right move, and doing it under Apache 2.0 rather than some restrictive license signals they’re serious. But remnants of the upload function are still visible in the codebase, just disabled. xAI says data storage has been off by default since July 12. The question isn’t whether the code is clean now—it’s whether developers who got burned will trust a Musk-led company with anything that touches their filesystem again. Trust like that doesn’t regenerate with a pull request.