SpaceX has open-sourced Grok Build, its AI-powered coding assistant, following a major privacy scandal where the tool was caught uploading users' entire code repositories to company-controlled cloud storage. The move came just days after security researchers at Cereblab exposed the data collection practice, prompting Elon Musk to publicly commit to deleting all retained data and giving users greater control over their information.

What Exactly Happened With Grok Build's Data Collection?

On Sunday, July 14, Cereblab researchers discovered that Grok Build was packaging up users' entire repositories as Git Bundles and automatically uploading them to Google Cloud storage. This happened without explicit user awareness or consent, raising serious privacy concerns in the developer community. The revelation triggered significant backlash, forcing SpaceX and Elon Musk to issue a public response within days.

The codebase itself is substantial: according to Simon Willison, creator of Datasette and co-creator of Django, Grok Build comprises 844,530 lines of Rust code. When SpaceX open-sourced the tool on Wednesday, July 16, the code responsible for sending repositories to the cloud remained visible, though it appears to have been altered to reverse the problematic behavior.

How Is SpaceX Addressing the Privacy Concerns?

SpaceX announced several concrete steps to restore user trust and protect privacy going forward. The company stated that it has always respected Zero Data Retention (ZDR) for enterprise customers, but acknowledged that data retention was enabled by default for all other users. This default setting has now been corrected.

The specific privacy protections SpaceX implemented include:

• Data Deletion: All coding data previously retained by Grok Build has been permanently deleted from company servers.
• Default Setting Change: Data retention is now disabled by default for all Grok Build users, a change that took effect on July 12.
• Open-Source Availability: Users can now run Grok Build fully open-sourced and local-first with their own inference, eliminating the need to send code to external servers.
• User Control: All users have always had the ability to disable data upload in the command-line interface, though this option was not prominently featured initially.

In a statement accompanying the open-source release, SpaceX declared: "With all retained data deleted, retention default off, and an open-source harness, we are offering complete user privacy. You can also run Grok Build fully open-sourced and local-first with your own inference".

Steps to Verify Grok Build's Security and Privacy

SpaceX has taken additional measures to demonstrate transparency and invite external scrutiny of the tool's security posture. The company is actively encouraging security researchers to examine the open-sourced code and report vulnerabilities through an official bug bounty program.

• Code Audit: Review the open-sourced Grok Build codebase on GitHub, which is now publicly available for inspection by any developer or security researcher.
• Bug Bounty Participation: Report security issues to SpaceX's bug bounty program, which offers rewards ranging from $100 to $20,000 depending on vulnerability severity.
• Local Deployment: Deploy Grok Build locally on your own infrastructure to avoid any cloud data transmission, using the open-source version with your own inference setup.
• Configuration Review: Verify that data retention is disabled in your Grok Build CLI settings, ensuring no code is uploaded to external servers.

The open-source release itself is notable for its structure: it consists of a single commit with no pull request history or git changelog visible, meaning users cannot see the incremental changes made to address the privacy issues. This approach allows SpaceX to present the corrected code while limiting visibility into exactly what was changed and when.

Why Does This Matter for Developers Using AI Coding Tools?

The Grok Build incident highlights a broader tension in the AI coding tool market: the trade-off between convenience and privacy. Many AI-powered development assistants require sending code to cloud servers for processing, but this creates potential risks if data retention policies are unclear or enabled by default. The scandal demonstrates that even well-known companies can implement problematic data practices, sometimes unintentionally.

SpaceX's decision to open-source Grok Build sets a precedent in the industry. By making the code publicly auditable, the company is attempting to rebuild trust through transparency rather than relying solely on corporate promises. This approach allows independent security researchers and developers to verify privacy claims themselves, rather than taking the company at its word.

The incident also underscores the importance of default settings in software design. SpaceX acknowledged that data retention was enabled by default for non-enterprise users, a choice that prioritized data collection over user privacy. The correction to disable retention by default represents a shift in the company's philosophy toward these tools.