Musk announces open-sourcing of Grok Build, developers can compile locally—will this put out the fire after the leak storm?

On July 15, xAI fully open-sourced the source code of its terminal-native programming agent Grok Build to GitHub, allowing developers to compile and inspect the code line by line on their own machines, without needing to rely on cloud computing.
(Background: Grok Build was caught exfiltrating users by uploading an entire “home directory” to the cloud, shocking developers: everything was leaked)
(Additional context: Musk’s xAI launched “Grok Build” to challenge Claude, with up to 8 parallel AI agents and a context window of up to 2 million tokens)

Table of Contents

Toggle

• Grok Build open-sourced
• Leaked secrets spread out—can’t be hidden
• Beyond open-sourcing, what’s still missing

Early this morning (16), Musk shared a post saying: SpacexAI has published the complete Grok Build code on GitHub. Developers can compile it locally and inspect it line by line themselves. However, the timing of this “great gift” is awkward—just days ago, Grok Build’s leaked data was uncovered: user passwords and keys were quietly packaged and sent to the cloud.

Was this open-sourcing meant to show sincerity, or to put out the fire?

Grok Build is now open source https://t.co/LbGepmRB3l

— Elon Musk (@elonmusk) July 15, 2026

Grok Build open-sourced

Grok Build is xAI (also referred to as SpaceXAI)’s terminal-native AI programming agent launched in May 2026. Officially, it touts running up to 8 parallel AI agents at the same time, with a context window of up to 2 million tokens, aiming to challenge Anthropic’s Claude Code and Cursor.

Now, xAI has open-sourced the complete Grok Build source code to the GitHub project xai-org/grok-build. Developers can compile it locally, modify the config.toml settings to run local inference, and no longer need to send data to xAI’s cloud.

The company frames this step as an official response to external concerns about privacy and transparency. In theory, once the source code is published, anyone can check what the tool is really doing behind the scenes, instead of relying solely on the official side of the story.

Spread-out source code—leaks that can’t be hidden

The recent storm centers on Grok Build version 0.2.93. An AI security researcher found that each time Grok Build reads and processes a file, it treats it as part of a model-call request. Inside the tool, a separate backend upload channel was hidden—not just uploading the partial files needed for the task, but packaging the user’s entire Git code repository, along with the full project code and historical modification records, into a Git bundle and uploading it to SpaceXAI’s storage on Google Cloud. The data was not de-identified at all.

How extreme was it? In one test, the task actually only required 192 KB of data, yet Grok Build uploaded 5.1 GB—2.6 ten thousand times the needed amount. Also packaged and sent along were operation logs, backend passwords, and API keys. The “privacy switch” the tool claims it can turn off had no effect in testing.

xAI’s first move was not to issue an apology publicly, but to quietly push a server-side fix to block the abnormal uploads, with no security advisory released and no mention in the update notes for the new version. It wasn’t until Musk stepped in personally that he publicly promised to completely and permanently delete all user data previously uploaded, without keeping backups. For non-enterprise users who had not enabled zero-data retention, the official provided a single command line so users could delete the previously collected data themselves.

Beyond open-sourcing, what’s still missing

There are still many unanswered questions. The server-side fix currently only confirms it works on a single device and a single account. Whether it has taken full effect globally has not been explained by the official. It’s also unclear whether the data was truly deleted, and there is no independently verified third-party audit to confirm it.

Some experts believe the real solution should be for the server side to directly prohibit uploading entire code repositories, rather than relying on users to manually run deletion commands as a workaround. Community reactions were also blunt: it’s hard to trust an AI assistant that has the highest level of access to a computer. For companies and independent developers that hand the entire development environment to AI agents, this incident is essentially a warning: the higher the privileges of a tool, the more rigorous audit mechanisms it needs.