Grok Is Leaking Your Repositories. So, What Now?
Independent researcher cereblab intercepted xAI's Grok Build CLI mid-upload and found it wasn't limiting itself to files the agent opened. The tool packaged the entire codebase, every version-controlled file plus its complete history, and sent a session's secrets right along with it, straight to a Google Cloud Storage bucket xAI operates. None of it depended on what the agent was actually told to touch.
If your team runs Grok Build, or any coding agent with broad git and filesystem access, this is already sitting in your environment. Disabling "improve the model" made no difference. That switch decides whether your data feeds training, not whether your source code leaves the machine, and most users have only ever seen the training switch.
In 30 minutes, Nevo Poran, Tenet's co-founder and CTO, walks through:
What cereblab's wire-level teardown actually proved, including a 12GB test case where the model itself only ever processed 192 KB of the repo while a separate channel moved 5.1 GiB in the background, nearly 28,000 times more data leaving the machine than the task required
How a coding agent with git access turns into a full-repo, full-history exposure, not just a file-read problem
What a real remediation looks like: what to rotate, what "deleted" secrets in git history still expose, and where the training toggle does and doesn't help
The defenses that actually hold up when a coding agent has broad repo access
This is a small session, so Nevo can actually answer what you bring. Come with questions.