{"schema_version":"0.10.0","id":"LR-2026-0626","record_version":1,"title":"xAI Grok Build uploaded full Git repositories and history to xAI storage","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":59.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":4.8,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"c280bffa43a34bca1b5b4872631452a74b339f8c03dd9c532ea46a40284d71d9"},"system":{"model_name":"Grok Build","model_version":"0.2.93","developer":"xAI","harness":"coding CLI","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-07-14","incident_class":"security_compromise","failure_class":"data_exfiltration","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"xAI's Grok Build coding CLI, a coding agent, sent entire Git repositories with full commit history to a Google Cloud Storage bucket run by xAI, beyond the files a task needed. A public researcher testing version 0.2.93 captured the uploads and recovered a planted file the agent had been told not to open. A tracked .env file was also read into the model turn and stored unredacted, though the secrets used in the test were fake. The researcher's teardown established transmission, acceptance and storage, not training. On July 13 the binary stopped making storage requests, and the server returned disable_codebase_upload: true. xAI has not said why full repositories were uploaded by default, how long they were kept, or how many users were affected.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"provider","adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: moderate tier, data of others touched. The sources state data of other users (repositories with customer data and credentials) was taken, but do not state a bounded scope or a count of affected parties, so no higher tier is met.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/07/grok-build-uploads-entire-git.html","publisher":"The Hacker News","date":"2026-07-14","type":"press","title":"Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123","publisher":"The Register","date":"2026-07-14","type":"press","title":"Musk promises purge after Grok Build caught sending entire repos to the cloud - The Register","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.model_name":"C","system.model_version":"C","system.harness":"C","event.agent_involved":"C","event.failure_class":"C","event.detection_method":"C","event.responsible_party":"C","event.incident_class":"D","impact.severity_because":"D","impact.severity":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed."}],"system.model_name":[{"source_index":0,"quote":"xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed."}],"system.model_version":[{"source_index":0,"quote":"A researcher publishing as cereblab, testing version 0.2.93, captured one of those uploads, cloned the git bundle out of the intercepted request, and pulled back a file the agent had been told in plain terms not to open."}],"system.harness":[{"source_index":0,"quote":"xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed."}],"event.agent_involved":[{"source_index":0,"quote":"A researcher publishing as cereblab, testing version 0.2.93, captured one of those uploads, cloned the git bundle out of the intercepted request, and pulled back a file the agent had been told in plain terms not to open."}],"event.failure_class":[{"source_index":0,"quote":"xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed."}],"event.detection_method":[{"source_index":0,"quote":"A researcher publishing as cereblab, testing version 0.2.93, captured one of those uploads, cloned the git bundle out of the intercepted request, and pulled back a file the agent had been told in plain terms not to open."}],"event.responsible_party":[{"source_index":0,"quote":"xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed."}],"event.incident_class":[{"source_index":0,"quote":"xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed."}],"impact.severity_because":[{"source_index":0,"quote":"A repo can hold proprietary code, internal URLs, customer data, and credentials that were removed from the working tree but still sit in commit history."}],"impact.severity":[{"source_index":0,"quote":"On July 13 the same 0.2.93 binary stopped making storage requests."}],"event.summary":[{"source_index":0,"quote":"xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed."},{"source_index":0,"quote":"A researcher publishing as cereblab, testing version 0.2.93, captured one of those uploads, cloned the git bundle out of the intercepted request, and pulled back a file the agent had been told in plain terms not to open."},{"source_index":0,"quote":"When Grok reads a file, its contents go into the model turn, and a tracked .env went with them unredacted, canary API_KEY and DB_PASSWORD values and all."},{"source_index":0,"quote":"What the captures establish is transmission, acceptance, and storage, not training."},{"source_index":0,"quote":"On July 13 the same 0.2.93 binary stopped making storage requests."},{"source_index":0,"quote":"And it still has not said why full repositories were uploaded by default, how long they were kept, or how many users were affected."}]},"notes_on_gaps":"No date of occurrence or detection is stated; the sources give no disclosure date beyond the article date, so date_disclosed is left out. The record does not state records exposed, users or third parties affected, duration, or root cause. Severity is moderate by judgement: the sources touch others' data but state no bounded scope, and no higher tier's test is met. The remediation is a server-side flag that the source says xAI has not confirmed reaches every account or is permanent; mapping it to H1 is my judgement. The 'Improve the model' toggle is described as not governing upload, but no control id was assigned to it. Advice to rotate credentials is in the source but not recorded as a remediation because no matching control id clearly applies. Source 1 is a site navigation listing with no incident content and was not used. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The coding CLI uploaded whole tracked repositories with their commit history, not only the files a task needed.","quote":"xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A credential file the agent read during a task was sent out and stored with no redaction.","quote":"The behavior is still the problem: a credential file the agent read during a task went out and was stored with no redaction.","source_index":0,"grade":"C"},{"step":"caught","text":"A public researcher, cereblab, captured an upload and recovered a planted file the agent had been told not to open.","quote":"A researcher publishing as cereblab, testing version 0.2.93, captured one of those uploads, cloned the git bundle out of the intercepted request, and pulled back a file the agent had been told in plain terms not to open.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/07/grok-build-uploads-entire-git.html","https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123"]},"analysis":{"sections":{"timeline":[{"text":"Researcher cereblab captured a repository upload and recovered a planted file the agent had been told not to open.","quote":"A researcher publishing as cereblab, testing version 0.2.93, captured one of those uploads, cloned the git bundle out of the intercepted request, and pulled back a file the agent had been told in plain terms not to open.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/07/grok-build-uploads-entire-git.html","https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123"]}}