Grok Build AI 编程工具被曝上传用户完整代码库至谷歌云

SpaceXAI 的 Grok Build AI 编码工具在被举报之前被发现将用户的整个代码库上传到 Google Cloud，公司随后将其关闭。《注册表》：https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123 报道称，Cereblab：https://cereblab.com/ 周一发布的研究显示，Grok Build CLI 正将整个代码库打包并上传，“包括被告知不要打开的文件和从历史记录中删除的秘密”，比类似工具如 Claude Code 保留的数据要多得多。

研究人员表示，截至周一，他们的测试显示 SpaceXAI 的服务器返回了 "disable_codebase_upload: true" 标志，代码库上传“已不再触发”。

伦敦国王学院的独立安全研究员 Lukasz Olejnik 博士向 The Verge 证实，这种数据保留量是“过度的”，并补充说可能存在风险的数据包括“专有源代码、安全漏洞信息、个人数据、基础设施细节以及凭证”。

SpaceXAI’s Grok Build AI coding tool was spotted uploading users’ entire codebases to Google Cloud before it was reported, and the company turned it off. The Register ：https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123 reports that Cereblab：https://cereblab.com/ published findings on Monday showing how the Grok Build CLI was packaging and uploading entire code repositories, “including files it was told not to open and secrets deleted from history,” significantly more data retention than similar tools like Claude Code.

The researchers say that as of Monday, their tests show SpaceXAI’s servers returning a “disable_codebase_upload: true” flag, and the codebase upload “no longer fires.”

Dr. Lukasz Olejnik, an independent security researcher at King’s College London, confirmed to The Verge that this amount of data retention is “excessive,” adding that the data potentially at risk could include “proprietary source code, information about security vulnerabilities, personal data, infrastructure details, [and] credentials.”