xAI Open-Sourced Grok Build, All 844,530 Lines of It. The Upload Code That Started the Scandal Is Still in the Tree.

TL;DR

xAI has open-sourced Grok Build, its terminal coding agent, under Apache 2.0. The announcement landed July 15, five days after a wire-level teardown showed the CLI uploading entire repositories, secrets included, to a Google Cloud Storage bucket. The release is the whole thing: agent loop, tools, TUI, and extension system, 844,530 lines of Rust, published as one squashed commit with no history. The upload machinery that caused the scandal is still in the source, now stubbed off, which means the most interesting part of this repo is the part xAI would probably rather you not read first.

What actually shipped

The repo at xai-org/grok-build describes itself as a coding agent harness and TUI: a full-screen terminal agent that reads your codebase, edits files, runs shell commands, and can run headlessly for CI or embed in editors via the Agent Client Protocol. It is extensible through skills and MCP servers, and the README says the tree is synced periodically from the company monorepo (which the README credits as the SpaceXAI monorepo, the branding on the repo itself).

Per Simon Willison's teardown of the release, the codebase weighs in at 844,530 lines of Rust, roughly 3% of it vendored. For scale, that is within striking distance of OpenAI's Codex CLI, the other frontier-lab harness you can read, at 950,933 lines of Rust. A terminal program that edits text files is now the size of a small operating system, and two labs have independently converged on that number.

Uptake was immediate: the repo crossed 8,800 GitHub stars within a day of the Hacker News thread hitting the front page. Prebuilt binaries still ship for macOS, Linux, and Windows, and you can now build the same agent from source.

Five days from packet capture to Apache 2.0

The sequence here is worth laying out plainly, because it is one of the fastest scandal-to-source-release arcs a major lab has produced. On July 10, a pseudonymous researcher published a mitmproxy capture showing Grok Build uploading 5.10 GiB of repository state from a 12 GB canary repo whose files the agent never read, against roughly 192 KB of visible model traffic, with the opt-out toggle changing nothing. On July 12, per xAI's own announcement, the company disabled trace uploads by default and deleted previously uploaded coding data. On July 15 the source went public, with a note that usage limits were reset for all users.

The announcement frames the release as letting anyone help make "a reliable and robust harness," and asserts that Grok Build "has fully respected zero data retention" since launch. It says this in the same breath as describing the coding data it deleted. A company claiming it always retained nothing, while wiping the data it retained, is a sentence you can now diff against the source code, which is the genuinely new part.

The receipts are still in the tree

Because the release is the real codebase and not a cleaned demo, the upload subsystem from the scandal shipped with it. The tree contains a full upload module, and its internal documentation plainly describes the plumbing the packet capture saw from the outside: a storage client for Google Cloud Storage, chunked byte uploads, and auth handling for the POST /v1/storage endpoint. There is even an end-to-end test named storage_upload_parks_on_401_and_drains_after_recovery.rs, which tells you this pipeline was engineered with care, not bolted on.

Willison confirmed the disable: the upload_session_state() function that archived and shipped session state now returns a hard-coded unavailability error. His read of the rest of the tree is worth your time too. The system prompts live as template files in the repo, including a subagent prompt that instructs the model not to reveal its contents, an instruction that is now itself world-readable. There is a custom Mermaid renderer that draws diagrams in the terminal with Unicode box characters, and several tool implementations ported from Codex and other agents, with third-party license attributions intact.

What one squashed commit does and does not buy you

The repo has exactly one commit: "Publish harness and TUI open-source." No history, no blame, no way to see when the upload pipeline was added, tuned, or turned off. Think of it as touring a house where every room is finally unlocked but the security tapes were wiped: you can inspect every lock today, and you still cannot see who had keys last month. For a release motivated by a trust incident, the history is precisely the part audit-minded users wanted.

The forward-looking value is real, though. From this point on, changes to the synced tree are diffable by anyone, and the transparency claim in the announcement is testable in a way a privacy policy never is. The remaining gap is the one that always applies: what you install from the release binaries is not automatically what the tree says, since the repo is a periodic one-way sync from an internal monorepo. If your threat model includes your vendor, build from source, or keep mitmproxy handy. The July 10 gist proved that a packet capture is the one privacy document nobody can edit after the fact.

The caveats, straight

• The original exfiltration findings remain one researcher's capture. xAI never publicly disputed them, and its July 12 default-off change plus data deletion is consistent with them, but no formal independent reproduction has been published.
• Zero-data-retention claims about xAI's servers are not verifiable from the client source. The code shows what leaves your machine, not what happens to it afterward.
• The single squashed commit means the codebase's past, including the upload subsystem's evolution, stays private. Only the present is auditable.
• Apache 2.0 covers the published tree. Prebuilt binaries and the hosted model service are separate trust decisions.

Key Takeaways

• xAI open-sourced Grok Build under Apache 2.0 on July 15: agent loop, tools, TUI, and extension system, 844,530 lines of Rust, alongside a usage-limit reset for all users.
• The release came five days after a wire capture showed the CLI uploading whole repositories to a GCS bucket with the opt-out doing nothing; xAI says uploads went off by default July 12 and stored coding data was deleted.
• The upload machinery is still in the published tree, stubbed to a hard-coded error at the entry point, so the mechanism behind the scandal is now readable by anyone.
• Per Simon Willison, the codebase is comparable in scale to OpenAI's Codex CLI (950,933 lines), includes its system prompts as template files, and ports several tools from Codex with attribution.
• One squashed commit means no history: the release makes the future auditable, not the past.
• For private code, the hierarchy stands: open-source harness built from source beats vendor binary, and a packet capture beats both vendors' promises.

Sources: xai-org/grok-build (GitHub), xAI announcement, Simon Willison's analysis, Hacker News discussion, cereblab's wire-level teardown (gist), GIGAZINE coverage