source: simon willison: xai-org/grok-build, now open source
level: technical
xai's grok cli tool faced backlash when users discovered running it in a directory could upload everything to xai's cloud buckets. one user reported it uploaded ssh keys, a password manager database, documents, photos, and videos from their home directory. xai responded by disabling the feature and deleting all previously uploaded data. they also released the entire grok build codebase under an apache 2.0 license to regain trust.
the repository contains 844,530 lines of rust, with only about 3% vendored. it includes a system prompt and a subagent prompt that oddly instructs not to reveal its contents. a self-contained terminal renderer for mermaid diagrams uses unicode box-drawing. tool implementations are ported from other coding agents like codex and opencode, with compliance to their licenses. remnants of the upload code remain but are disabled, returning an error instead.
the codebase reveals the complexity of terminal coding agents, comparable to openai's codex at 950,933 lines of rust. xai claims these steps offer complete user privacy, with data retention off by default and the option to run grok build fully open-sourced and local-first. the single commit release provides no development history, but the open code allows inspection and local use.
why it matters: open-sourcing lets developers audit the code for privacy issues and run the agent locally, reducing reliance on cloud services.