Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read

xAI's Grok Build CLI (version 0.2.93) was observed uploading full Git repositories — including commit history and tracked secret files (.env with API_KEY and DB_PASSWORD) — to a Google Cloud Storage bucket (grok-code-session-traces). A researcher captured a bundle, recovered a planted 'never_read_canary.txt' and confirmed secrets that were read by the model were stored unredacted. xAI later flipped server-side flags to stop uploads, but the binary still contains the upload code; users are advised to rotate any credentials that could have been sent.