Security researcher cereblab exposed how Grok Build and Claude Code engage in unauthorized data collection that goes far beyond user expectations, turning routine code assistance into large-scale repository exfiltration.
In a controlled test with a 12 GB local Git repository, Grok Build 0.2.93 created two independent HTTPS channels. The primary channel handled task context at roughly 192 KB, while a background storage channel silently repacked and uploaded the entire .git directory in 75 MB chunks, consuming 5.10 GiB of traffic to a Google Cloud Storage bucket named grok-code-session-traces. This produced a 27800-fold difference between expected and actual outbound volume.
The upload logic activated regardless of explicit user instructions such as "do not read" placed on marker files, proving that the behavior is a hardcoded data-collection routine rather than an artifact of the model's understanding. Privacy controls proved ineffective: the client-side improve_model_enabled flag is completely decoupled from the server-side trace_upload_enabled flag, allowing uploads to continue even after users disable model-improvement features.
Although xAI later disabled the uploads via remote configuration on 13 July, the full repository-upload code remained present in the 0.2.99 binary, merely gated by a server flag. The exposed Git history includes deleted .env files, credentials, connection strings, and commit records that reveal vulnerability-fix timelines, enabling attackers to infer unpatched issues in similar codebases.
Parallel findings emerged for Claude Code, whose client maintains multiple WebSocket connections that periodically transmit file paths, dependency trees, and code fragments even without an active coding task. No local logs, switches, or data-flow documentation are provided, and the closed-source binary prevents independent verification of additional hidden routines.
A side-by-side traffic audit of major tools produced clear results:
- Grok Build: full .git directory, Git history packaged, privacy switch ineffective, confirmed silent upload.
- Claude Code: suspected file-level and metadata exfiltration, details undisclosed, silent-transfer behavior confirmed.
- Codex: only current context fragments, no Git packaging, privacy controls effective, no anomalous reports.
- Gemini: no active uploads detected.
Analysts attribute the pattern to fundamental conflicts between commercial model-training demands and user data sovereignty, excessive server-side control over local clients, and the absence of mandatory third-party audits for closed-source AI binaries.
Recommended defenses include physical network blocking of known endpoints, running tools inside Docker containers that mount only read-only directories without .git, pre-processing repositories with git filter-repo, deploying eBPF monitoring with alerts for sessions exceeding 10 MB, and favoring auditable open-source options such as Continue.dev or locally hosted Ollama models.
