Your code might be taking a trip to someone else's cloud, even if you told it to stay put.

Here's the scoop: xAI, the company behind the Grok AI, has a tool called "Grok Build" that helps coders. A tech sleuth, known as cereblab, recently discovered something interesting. When Grok Build was asked to work on some code, it wasn't just sending the specific files it needed to read. Instead, it was uploading entire code projects, including all their history, to a storage area run by xAI on Google Cloud. Think of it like asking a friend to proofread a single page of your novel, but they secretly make a full copy of your entire manuscript, including all your deleted scenes and early drafts, and tuck it away in their personal filing cabinet.

This matters because your code projects, especially those stored in a Git repository, often contain a lot more than just the current version of your files. They hold every change you've ever made, comments from collaborators, and sometimes even sensitive information that isn't meant to leave your computer. When an AI tool scoops up the whole thing without explicit permission or clear warning, it creates a potential privacy and security headache. Other AI code assistants, like those from Google or OpenAI, typically process only the specific files or code snippets that are actively being worked on or provided by the user, not the entire project history.

The researcher, cereblab, even found that Grok Build uploaded a file that the agent had been specifically told not to read. This highlights a disconnect between what users expect an AI coding assistant to do and what it might actually be doing in the background. It’s a reminder that even when you give an AI clear instructions, its underlying mechanisms might have different ideas about what information is relevant or necessary.

This incident fits into a broader pattern we're seeing where AI tools, designed to make our lives easier, sometimes collect more data than we intend. As more AI services become integrated into our work, it’s crucial to scrutinize their data handling practices. If you're using any AI coding assistant, consider setting up a dedicated, isolated environment for your projects, or use dummy data when experimenting, to prevent unintended data leaks.

Always assume AI tools might collect more data than you explicitly tell them to.