Musk pledges to open-source X’s full codebase after Grok data scandal

Developers discovered last week that xAI's Grok Build coding assistant was silently uploading entire code repositories to Google Cloud Alphabet Inc. ↘ 1.11% storage, transmitting roughly 27,800 times more data than the coding tasks actually required. The revelation has triggered a trust crisis around xAI's developer tools and prompted Elon Musk to announce that X will make its entire codebase open source.

The Discovery

A security researcher using the handle "cereblab" published a wire-level analysis on July 12 showing that Grok Build's command-line interface was packaging users' full Git repositories — including complete commit histories, .env files containing API keys and database passwords, and files the agent was explicitly denied permission to read — and sending them to a Google Cloud Storage bucket named "grok-code-session-traces." The upload occurred regardless of whether the user had disabled the "Improve the model" option, and the tool's opt-out toggle did not stop the transfers.theverge+4

Testing by researchers showed the tool shipped approximately 5.1 GB across 73 chunks from a single 12 GB repository. After the findings gained traction on Hacker News and social media, xAI applied a server-side fix around July 13, with Grok Build's servers now returning a "disable_codebase_upload: true" flag. The company issued no formal security advisory or changelog entry to acknowledge the behavior.aiweekly+3

Industry Reaction and Musk's Response

OpenAI CEO Sam Altman weighed in on July 14 with a one-word post on X — "Concerning" — in response to a thread detailing the uploads. The remark underscored the competitive tensions between xAI and OpenAI, whose own Claude Code competitor operates in the same AI coding tool market.ground+1

Musk confirmed the uploads had occurred and said all previously collected user data would be "completely and utterly deleted." He added that "privacy settings are always respected" but asked users to allow data retention, calling it "helpful for debugging issues."thenextweb+2

Open-Source Pledge

On July 15, Musk escalated his transparency commitments. "Once we have completed our review for security vulnerabilities, we will make the entire codebase of X open source, with no exceptions," he wrote on X. He said the company would invite independent reviewers to verify that the published code matches what runs on production servers, adding: "Trust through complete transparency is the only reliable way."thenews+3

The pledge extends beyond X's 2023 release of its recommendation algorithm, encompassing every module powering the platform. No timeline for the security review's completion has been given.