CoinEx News: On July 12, an independent security researcher published a reproducible test of xAI’s Grok Build CLI version 0.2.93. Captured network traffic showed the tool uploading Git bundles containing every tracked file and full commit history, including a planted file the agent was told not to open; sensitive credential files it actively read were also transmitted without redaction.

The test proves transmission and storage, not model training or malicious use, but developers using cloud coding agents should remove secrets from Git history and avoid exposing private repositories until xAI clarifies the behavior or confirms a fix.