Summary of Key Findings
The Grok CLI (an AI code tool developed by X.A.I.) has been found to have serious privacy issues: it secretly packages and uploads your entire code repository, configuration files from other tools (such as Claude Code), and even sensitive information including API keys to X.A.I.'s cloud servers without your knowledge. Even more baffling is that, after the issue was exposed, X.A.I. quietly turned off this upload feature via a remote switch, yet the complete upload process is still retained in the code, ready to be reactivated at any time. This incident highlights the current industry situation where AI Agent tools have excessive permissions and lack proper regulation, leaving user privacy virtually unprotected.
What Does the Grok CLI Do? – Secretly Stealing Your “Secrets”
Do you think using Grok to write code is just about letting AI help you fix bugs? Think again. It does much more than that:
- It doesn’t read files normally: While typical AI tools read files to answer your questions (for example, “Show me where this function is wrong”), Grok creates an invisible “backdoor” and compresses the entire code repository into a tar.gz package for upload.
- It steals beyond what’s allowed: It doesn’t just transfer the code from the current project; it also copies configuration files from other tools across directories. For instance, during testing, Grok automatically scanned Claude Code’s configuration file (.claude.json) and transferred the Baidu API key along with it—although the author never allowed it to access those files!
- The whole process is silent: You don’t notice anything; there are no pop-ups or logs indicating that your files are being uploaded. It’s like someone sneaking into your house to move things while you’re still watching TV in the living room.
The Proof: From Doubt to Shock
Initially, the author thought, “That can’t be true; X.A.I. is a legitimate company.” But professional habits prompted him to verify the situation:
1. Verifying the software’s authenticity: He installed the official X.A.I. npm package (version 0.2.93) and confirmed it was signed by X.A.I., ruling out any fake versions.
2. Discovering the hidden secrets in the code: After deobfuscating the software’s binary files, he found clear references to “upload repository status,” “before_codebase.tar.gz,” and “gs://grok-code-session-traces (X.A.I.’s Google Cloud repository)” – these are parts of a complete upload pipeline, not just random test code.
3. Testing the upload switch: When using an isolated repository for testing, the X.A.I. server indicated that the upload was disabled (logs showed “skip upload”). However, once the switch was manually turned on, Grok uploaded the entire repository, Claude’s configuration, and the API key.
4. Evidence from a security researcher: Another researcher, cereblab, saved packet capture records from July 10th; at that time, the upload feature was enabled by default. It wasn’t until July 12th that someone exposed the issue, and on July 13th, X.A.I. remotely turned off the switch (the software itself hadn’t been updated, but its behavior had changed).
Why Does X.A.I.’s Behavior Indicate “Guilt”?
Why does X.A.I.’s behavior suggest it’s at fault?
- If this upload feature were “reasonable” (e.g., for diagnostic purposes), it would either inform users or allow them to enable it manually. But after the issue was exposed, X.A.I. silently turned it off without any explanation – this is like admitting that the behavior is inappropriate.
- Even more concerning: The upload process is still built into the code, meaning X.A.I. could re-enable it at any time via the server. It’s like someone has a copy of your house key; they haven’t entered yet, but the key remains in their possession.
How Is Grok Worse Than the Claude Code Incident?
Previously, Anthropic’s Claude Code was found to use invisible characters to label Chinese users, which was annoying but not particularly harmful (it only added tags without stealing data). In contrast, Grok CLI directly steals your valuable assets:
- Claude is like “secretly labeling a delivery order”; Grok is like “copying your house key and also taking the neighbor’s key.”
- Claude didn’t touch your code or keys; Grok packages and takes away all the sensitive information from your computer – this is not just annoying; it’s a clear case of data theft.
The “Unprotected Era” of AI Agents: Who Will Regulate These Super-Powered Tools?
Current AI agents (like Grok CLI and Claude Code) have frighteningly high levels of permission:
- They can read all files on your computer, execute commands, and even control your browser. Their permissions are comparable to those of an operating system or antivirus software, but these latter have undergone decades of security audits and regulation. AI agents, however, have almost none.
- There are no industry standards requiring AI agents to disclose which files they’ve read or obtain user consent for uploads; nor do any third-party organizations audit their backend operations. Users can only learn what these tools are doing through “reverse engineering” (by analyzing the software code).
Final Warning: If you have Grok CLI installed, uninstall it immediately! Until AI tools are properly regulated, be cautious when using any of them – don’t let your code and keys become part of someone else’s “training data.”
Hopefully, we won’t have to rely on reverse engineering to understand what these tools are doing in the future. Until that day arrives, it’s always wise to stay vigilant.