The point: Grok Build copied entire code repositories and SSH keys to cloud storage without user consent instead of processing them locally for prompts.
Elon Musk’s AI system Grok Build transferred complete codebases, SSH keys and other sensitive files in gigabyte volumes to cloud storage without user authorization – instead of processing only small code snippets for prompts.
The AI system Grok Build from xAI did not limit itself to what was necessary for prompt processing during code analysis. Instead, the system transferred complete Git repositories, SSH keys and other sensitive files to external cloud storage backend – without explicit user consent.
For a CISO, this is a critical security incident: the uncontrolled transfer of gigabytes of code assets and authentication material to external cloud infrastructure violates fundamental data protection and access control principles. SSH keys are considered highly sensitive; their undetected exfiltration opens attack vectors to Git repositories, CI/CD pipelines and other critical systems.
The incident points to a design problem: AI tools with code analysis functionality require clear, enforceable boundaries for data access and transfer. The lack of transparency regarding actual data usage and the discrepancy between expected behavior (kilobytes for inline processing) and actual behavior (gigabytes to cloud) necessitate a review of integration policies for AI systems in DevOps environments.
Source: www.golem.de · Published July 15, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.