Home / Technology / AI Coder Uploads Secrets to Cloud
AI Coder Uploads Secrets to Cloud
15 Jul
Summary
- AI tool uploaded entire codebases, including sensitive data.
- Company disabled the feature after security researchers reported it.
- Elon Musk promised deletion, but asked users to allow data retention.
A concerning incident involving SpaceXAI's Grok Build AI coding tool has come to light, with researchers discovering it was uploading entire user codebases to Google Cloud. This occurred despite instructions to exclude certain files and even after secrets were removed from commit history.
The security researchers published their findings on Monday, revealing the extensive data retention by the tool. Shortly after these findings were made public, the codebase upload functionality was disabled by SpaceXAI.
In response to the outcry, Elon Musk posted on X, assuring users that all previously uploaded data would be completely deleted. However, he also requested users allow SpaceXAI to retain their data, citing its helpfulness for debugging issues.
Independent security experts have described the data retention practices as excessive. They highlighted potential risks, including the exposure of proprietary source code, security vulnerabilities, personal data, infrastructure details, and credentials.
SpaceXAI's initial statement suggested that a per-session privacy command could disable data retention. However, researchers pointed out that this command was not the fix for the issue and that the upload was occurring regardless of this setting.
