What exactly happened?
A developer identified as @a_green_being on X (formerly Twitter) reported that, after running the Grok Build CLI —xAI’s AI-assisted development tool (the company run by Elon Musk)— from his home directory, the client automatically uploaded the complete contents of the directory to Google Cloud Storage servers.
The finding quickly spread on Hacker News, where it reached more than 280 points and generated intense debate. The original X post showed how the Grok agent had uploaded the user’s entire home directory, including configuration files, SSH keys (~/.ssh), authentication tokens, personal documents and the bash history.
How does Grok CLI work?
Grok Build is xAI’s command-line tool that allows developers to use the Grok AI model directly from their terminal for programming tasks. Like other coding assistants (GitHub Copilot, Claude CLI, Cursor), the tool needs to access the source code of the project being worked on.
The problem lies in how that access is implemented. When starting a session, Grok CLI determines the current repository or directory and —automatically, without asking the user— uploads the contents of the directory where the command is run to xAI’s servers so that the model can work with them.
In this case, the user ran the command from their home directory (~/ or /home/user), and the tool interpreted that the whole home was the «repository» it had to upload. SSH keys, tokens, documents, downloads, configurations… everything was sent to the cloud.
The underlying debate: trust and sandboxing
The incident is not isolated. It is part of a growing concern in the tech community: AI-based coding assistants access entire file systems without adequate controls.
The reactions in the community were immediate:
- Several developers noted that similar tools (Claude CLI, ChatGPT desktop) also access the entire file system if their scope is not explicitly limited.
- Others pointed out that this is inherently dangerous: AI tools should not have unrestricted access to the local file system.
- Practical solutions emerged, such as running these agents inside Docker/Podman containers or in disposable virtual machines.
- A developer has already created an open source alternative (oh-my-pi-plugin-grok-build) that allows using Grok Build with your own endpoint without sending private data to xAI.
One of the most insightful comments in the Hacker News debate: «People give LLMs full access to their systems and then are surprised when they do something stupid. What are sandboxes for?»
What should xAI do?
The main criticism is that Grok CLI does not warn the user before uploading files and does not limit the scope to a specific directory by default. The ideal solutions would include:
- Ask the user before uploading any file.
- Limit the scope to the specified working directory, not the whole home.
- Implement a sandbox mode that restricts file access.
- Be transparent about what data is uploaded and where.
Lessons for the user
Until companies implement these protections, developers should:
- Always run AI agents from a specific project directory, never from ~/.
- Use containers (Docker/Podman) to isolate the agent’s environment.
- Review what permissions you grant to each tool.
- Consider open source alternatives where you have full control over the data.
