xAI's Grok Build CLI Faces Scrutiny Over Undisclosed Repository Uploads to Cloud Storage

 written by: zaganelli, Majesty

xAI's Grok Build CLI Faces Scrutiny Over Undisclosed Repository Uploads to Cloud Storage

In a rapidly evolving AI development landscape, where tools promise seamless integration of large language models into professional workflows, a recent disclosure has raised significant questions about data handling practices at xAI. Security researchers have revealed that the company's Grok Build CLI, a terminal-based coding agent powered by advanced models including the newly released Grok 4.5, was uploading entire Git repositories—including full history, unread files, and potentially sensitive secrets—to a Google Cloud Storage bucket.

This incident, which came to light in mid-July 2026, highlights ongoing tensions between the drive for powerful agentic AI capabilities and the imperative for transparent, secure data practices in enterprise software tools.

Background on Grok Build and Recent xAI Advancements

xAI, the AI venture associated with Elon Musk, has positioned Grok as a truth-seeking, high-performance alternative in the competitive frontier model space. The release of Grok 4.5 on July 8, 2026, marked a notable step forward, with the model optimized for coding, agentic tasks, and knowledge work. It has demonstrated strong performance on benchmarks such as SWE-Atlas-QnA and improvements in real-world agent arenas, often praised for token efficiency and speed compared to rivals like Claude models.

Grok Build CLI, launched in beta earlier in 2026, extends these capabilities directly into developers' terminals. Marketed for complex coding tasks, refactoring, Git integration, and multi-agent workflows, it allows users to delegate substantial engineering work to Grok while operating within local codebases. Features include file reading/writing, shell command execution, and integration with tools like Linear or Postgres via MCP standards.

However, the tool's architecture for delivering superior context and agentic performance appears to have involved comprehensive data transmission that was not clearly documented or controlled by user-facing settings.

Details of the Disclosure

Independent security researcher cereblab conducted a wire-level analysis using mitmproxy, routing traffic from Grok Build CLI version 0.2.93. The investigation revealed that, upon invocation, the tool packaged the entire tracked Git repository—including full commit history—as a Git bundle and uploaded it via a POST request to a Google Cloud Storage endpoint (specifically, the grok-code-session-traces bucket).

Crucially, this upload occurred independently of the specific files the AI agent was instructed to access or the task at hand. In controlled tests, even with prompts explicitly directing the model not to read any files, the full repository was transmitted. On a 12 GB test repository, the storage upload reached approximately 5.1 GB, dwarfing the 192 KB of task-relevant traffic. A planted canary credential in a .env file was captured verbatim in the traffic.

The "Improve the model" opt-out toggle, which users might reasonably interpret as a data-sharing control, did not prevent these uploads. Server responses continued to indicate trace_upload_enabled: truedespite the setting being disabled. Documentation did not prominently disclose the behavior, despite the tool's "local-first" marketing.

Response and Mitigation

Following the public disclosure around July 11-12, 2026, xAI implemented a server-side change. Retests by the researcher showed the server now returning disable_codebase_upload: true, effectively halting the full repository uploads. This mitigation was delivered silently without a client update or public advisory.

As of the latest reports, xAI has not issued a formal statement addressing the scope of prior uploads, data retention policies, deletion of collected repositories, potential access by personnel, or use in training. The official changelog for subsequent versions, such as 0.2.98, made no mention of the repository upload functionality.

Community discussions on platforms like Hacker News and Reddit have underscored developer concerns, particularly for proprietary codebases, IP-sensitive projects, or environments with credentials. Some users have shared mitigation steps, such as environment variables (GROK_TELEMETRY_TRACE_UPLOAD=0) or strict .gitignore practices, while others question the long-term viability of closed-source tools without verifiable auditability.

Implications for AI Coding Tools and Developer Trust

This episode reflects broader challenges in the AI agent space. Advanced coding assistants benefit enormously from rich context—full repository awareness can enable better multi-file reasoning, refactoring, and sub-agent coordination. However, transmitting complete codebases by default introduces substantial risks of unintended data exfiltration, especially when secrets are involved or when opt-outs prove ineffective.

Competitive tools from other providers, according to the researcher's comparisons, were found to transmit only files explicitly accessed by the agent, remaining more contained. The incident has prompted calls for greater transparency, open auditing where possible, and clearer documentation of data flows in AI development tools.

For enterprises, the event serves as a reminder to review telemetry settings rigorously, isolate sensitive repositories, and consider network-level controls or air-gapped environments when experimenting with new AI agents. It also underscores the value of wire-level verification for mission-critical tools.

Looking Ahead

xAI continues to push boundaries with Grok 4.5's integration across platforms like Cursor and its CLI offerings, amid ambitious roadmaps for even larger models. The company's silence on this specific matter contrasts with its typically communicative style on product launches and benchmarks. Moving forward, addressing developer feedback with detailed post-incident transparency—covering data handling, retention, and safeguards—will be essential to rebuilding confidence among professional users.

As AI coding agents become integral to software engineering, incidents like this will likely accelerate industry-wide discussions on privacy-by-design, consent mechanisms, and accountability standards. Developers and organizations are advised to stay informed through official channels and independent security analyses while weighing the productivity gains of these powerful tools against their operational risks.

Footnotes / Sources

1. International Cyber Digest article: https://www.internationalcyberdigest.com/xais-grok-build-cli-uploads-entire-git-repositories-to-a-google-cloud-bucket/
2. Original X post by @IntCyberDigest: https://x.com/IntCyberDigest/status/2076689215258014069
3. Landian News coverage: https://www.landian.news/archives/113901.html
4. Researcher gist and analysis: https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547
5. xAI Grok 4.5 announcement: https://x.ai/news/grok-4-5
6. Additional discussion: Hacker News thread on wire-level analysis.
7. Reddit r/LocalLLaMA thread on the disclosure.

SEO Keywords: Grok Build CLI, xAI Grok security issue, Grok repository upload, Grok 4.5 release, AI coding agent privacy, Grok data exfiltration, xAI cloud storage bucket, developer tools data leak, Grok CLI Git bundle, AI agent security risks.

Index/Tags: AI Development Tools, xAI, Grok 4.5, Cybersecurity, Data Privacy, Software Engineering, Git Repositories, Agentic AI.

The Prosecution of Peter Stokes: A Case Study in the Disruption of Scattered Spider (Octo Tempest) and the Evolution of Transnational Cybercrime

written by: zaganelli,majestyAbstractIn an era where cyber threats transcend national borders with unprecedented velocity, the superseding criminal complaint filed in the United States District Court for the Northern District of Illinois against Peter Stokes, a dual United States-Estonian citizen born in 2006, represents a significant milestone in federal efforts to dismantle sophisticated ransomware and extortion enterprises. Operating under the monikers “Bouquet,” “Spencer,” and “Jordan,” Stokes stands accused of membership in the cybercriminal collective known variably as Scattered Spider, Octo Tempest, UNC3944, and 0ktapus. [2]This group has been linked to over 100 network intrusions, generating in excess of $100 million in ransom payments alongside substantial ancillary damages to victims across critical infrastructure and private enterprise sectors. The complaint, executed by Special Agent Ali Sadiq of the Federal Bureau of Investigation, details allegations spanning conspiracy to defraud the United States (18 U.S.C. § 371), violations of the Computer Fraud and Abuse Act (18 U.S.C. § 1030), wire fraud (18 U.S.C. § 1343), and related aiding-and-abetting provisions. [3]This paper provides a comprehensive doctrinal, factual, and strategic analysis of the United States v. Peter Stokes matter (Case No. 25 CR 812), drawing directly from the unsealed superseding complaint and supporting affidavit. It situates the case within the broader architecture of modern cyber-enabled extortion, examines evidentiary methodologies leveraging private-sector telemetry, explores jurisdictional and extradition challenges, and assesses implications for deterrence, attribution, and international cooperation in cyberspace. [4]I. Introduction: The Rise of Scattered Spider and the Profile of a Teenage Cyber OperativeScattered Spider emerged prominently around 2022 as a decentralized, agile collective distinguished by heavy reliance on social engineering—particularly vishing (voice phishing) and credential manipulation—rather than purely technical exploits. Unlike state-sponsored advanced persistent threats (APTs), this group operates with a ransomware-as-a-service (RaaS) orientation, frequently partnering with or leveraging tools such as DragonForce, while maintaining operational security through VPNs, proxy services, remote desktop protocols (RDP), and encrypted communications. [2]Peter Stokes, aged 19 at the time of key proceedings, exemplifies a new archetype: the digitally native, geopolitically mobile cybercriminal. A dual citizen who resided in Tallinn, Estonia, and the United Arab Emirates, Stokes allegedly participated in intrusions while still a minor. His activities, per the affidavit, include direct involvement in data exfiltration, ransom negotiation, and infrastructure management for multiple victims. [5]State Department records, provider data, and social media telemetry portray an individual who transitioned rapidly from adolescent experimentation to operational sophistication, boasting luxury travel, high-value assets, and insider knowledge of group activities. This profile raises profound questions about the intersection of socioeconomic privilege, transnational mobility, and low-barrier entry into high-yield cybercrime. [6]II. Factual Allegations: Anatomy of the Charged ConductA. The Scattered Spider Enterprise (Count One and Count Five – Conspiracy)The core allegation frames Stokes as a participant in a long-running conspiracy to access protected computers without authorization, exfiltrate data, deploy disruptive code, and extort victims. The group’s modus operandi typically begins with social engineering attacks on help desks or employees to reset multifactor authentication (MFA) credentials, followed by lateral movement, data theft, and ransomware deployment or pure extortion via data-leak threats. [2]Evidence includes Microsoft cybersecurity referrals identifying “Spencer” as Stokes, handling malware and files linked to Octo Tempest operations since at least 2022. Subject Server 1—a virtual private server—contained exfiltrated data from multiple victims, including Company Q (insurance) and Company S, with file counts exceeding 250,000 per entity in dedicated folders. Losses for individual victims reached $15–20 million. [7]B. Specific Intrusion: Company H (March 2023)When Stokes was approximately 16 years old, he allegedly collaborated with a co-conspirator (using accounts linked to “Auth”) in compromising an online communication platform (Company H). Chat logs recovered from the victim’s systems capture real-time coordination: requests for virtual machine access, AnyDesk sessions, database searches, account disabling, and operational security awareness (“we should not be talking on [Company H]”). [8]These exchanges demonstrate not only technical access but tactical collaboration, including searches by credit card numbers and efforts to maintain persistence while minimizing detection.C. Company F Luxury Jewelry Retailer Intrusion (May 2025 – Counts Two, Three, Four, Six)This incident forms the factual centerpiece for the substantive charges. Between May 12–15, 2025, threat actors allegedly:

• Conducted vishing calls from Google Voice numbers to the Company F IT help desk, impersonating employees.
• Secured resets for standard and high-privilege administrative accounts.
• Leveraged ngrok for tunneling and persistent access to a New Jersey data center.
• Exfiltrated sensitive data via a secure tunneling tool account created by Stokes from a specific VPN IP (.168), correlated to his Microsoft Global Device Identifier (GDID). [8]

A ransom demand of approximately $8 million in cryptocurrency followed. Company F incurred at least $2 million in direct costs from disruption, response, and recovery. Provider records, IP correlation, and device telemetry tightly attribute the tunneling account creation and data movement to Stokes. [5]Additional corroboration derives from Subject Server 1 RDP logs overlapping with Stokes-linked residential and account access IPs, birthday-timed operational chatter, and social media exhibiting wealth consistent with proceeds. [7]III. Evidentiary Foundations: Public-Private Intelligence FusionThe investigation exemplifies mature public-private partnership. Microsoft’s threat intelligence teams provided critical referrals based on telemetry, machine IDs, IP linkages, and malware associations. Court-authorized searches of Stokes’ Snapchat, Apple, and Facebook accounts yielded self-incriminating imagery (luxury items, “HACK THE PLANET” jewelry), travel documentation, and group references. [2]Forensic recovery from Subject Server 1, including victim data folders, Telegram search bots for exfiltrated material, virtual Android devices with MFA apps, and DragonForce ransomware chats, supplied direct linkage. Traditional attribution was augmented by GDID matching, time-zone correlated logs, and passport/travel records. [9]This multi-vector approach mitigates common defense challenges to digital evidence reliability.IV. Jurisdictional Reach, Extradition, and ArrestVenue in the Northern District of Illinois rests on the Eastern Division’s connection to victim impacts and investigative headquarters. Stokes’ April 10, 2026, arrest in Finland—while attempting to board a flight to Japan—pursuant to an Interpol Red Notice predicated on the initial warrant, followed by extradition and initial appearance in Chicago, demonstrates effective treaty mechanisms despite dual citizenship and third-country residency. [4]Seizure of two terabyte-scale hard drives at arrest further bolsters the government’s position. The superseding complaint, dated around April 2026, incorporates post-initial-complaint developments. [1]V. Legal Analysis: Charging Strategy and Potential DefensesThe charging menu is robust:

• Conspiracy (18 U.S.C. § 371) aggregates multiple underlying CFAA and extortion objects.
• Substantive CFAA counts address unauthorized access (§ 1030(a)(2)), damage/transmission (§ 1030(a)(5)), and extortion (§ 1030(a)(7)), with enhancements for financial gain, aggregate loss >$5,000, and multiple computers.
• Wire fraud and conspiracy cover the broader scheme, including interstate transmissions.

Aiding-and-abetting liability (§ 2) extends to co-conspirators. Defenses may contest attribution (challenging GDID/IP correlations), argue lack of specific intent for certain acts, or raise extraterritoriality issues—though courts have broadly upheld CFAA application to foreign actors causing domestic harm. Youth at the time of some conduct may inform sentencing but does not negate adult charging. [5]VI. Broader Implications for Cyber Policy and National SecurityThe Stokes case underscores several systemic realities. First, the democratization of cyber tools lowers entry barriers for juveniles and non-state actors, enabling outsized impact. Second, social engineering remains more effective than many technical controls, highlighting persistent human vulnerabilities in MFA and help-desk processes. Third, cryptocurrency’s role in ransom demands facilitates rapid monetization while complicating tracing. [10]International cooperation—via Interpol, bilateral extradition treaties, and intelligence sharing—proves indispensable. Microsoft’s role illustrates the necessity of platform accountability and data-sharing frameworks. Domestically, the case reinforces the FBI’s Cyber Division priorities and the Department of Justice’s focus on disrupting ransomware ecosystems. [1]For the private sector, lessons include zero-trust architecture, rigorous vendor/partner vetting, help-desk call verification protocols, and rapid incident reporting. Insurance implications and regulatory expectations under frameworks like SEC cybersecurity disclosure rules will likely intensify. [6]VII. Conclusion: Toward a Deterrence Equilibrium in CyberspaceThe apprehension and extradition of Peter Stokes signals that even agile, pseudonymous actors within decentralized collectives are not beyond the reach of law enforcement. While no single prosecution dismantles an enterprise like Scattered Spider, cumulative actions erode operational capacity, raise risk premiums for participants, and deter aspirants. [11]Future scholarship and policy must address root enablers: jurisdictional safe havens, cryptocurrency anonymity, talent pipelines into cybercrime, and the balance between privacy and lawful telemetry access. As Stokes proceeds through the federal justice system, the case will serve as both precedent and cautionary tale in the ongoing contest between digital innovation and its criminal exploitation. [12]The full weight of the United States’ investigative and prosecutorial apparatus, coordinated across borders, continues to affirm that cyberspace is not a lawless domain. Accountability, though sometimes delayed by geography and technology, remains attainable through persistent, intelligence-driven enforcement.References / Footnotes

1. U.S. Department of Justice, U.S. Attorney’s Office for the Northern District of Illinois, Press Release: “Alleged Member of Criminal Cyber Hacking Group Scattered Spider Arrested in Finland and Extradited to the United States” (July 2026). https://www.justice.gov/usao-ndil/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and
2. Superseding Criminal Complaint and Affidavit, United States v. Peter Stokes a/k/a “Bouquet,” “Spencer,” and “Jordan”, Case No. 25 CR 812 (N.D. Ill.). https://www.justice.gov/usao-ndil/media/1450651/dl?inline
3. Ibid. (charging sections detailing 18 U.S.C. §§ 371, 1030, 1343, and 2).
4. The Record Media: “Teen suspect in Scattered Spider hacks is extradited to US.” https://therecord.media/teen-suspect-in-scattered-spider-hacks-extradited-to-us
5. Bleeping Computer: “Alleged Scattered Spider hacker extradited to the United States.” https://www.bleepingcomputer.com/news/security/alleged-scattered-spider-hacker-extradited-to-the-united-states/
6. CyberScoop: “Alleged longstanding member of Scattered Spider...” https://cyberscoop.com/scattered-spider-peter-stokes-cybercrime-extradition/
7. Superseding Criminal Complaint, supra note 2 (sections detailing Subject Server 1 and victim data).
8. Ibid. (detailed factual narrative on Company H and Company F intrusions).
9. Additional technical attribution references in the affidavit and related reporting.
10. The Hacker News and related coverage on the May 2025 luxury retailer incident.
11. DOJ statements on group impact and cumulative enforcement.
12. Broader analysis drawn from official filings and public threat reporting.

This scholarly analysis is derived exclusively from the referenced public filings and official statements for academic and informational purposes. All citations correlate directly to the primary court documents and authoritative sources.

SEO Optimized Search Terms (for Indexing and Discovery)

• Peter Stokes Scattered Spider
• Peter Stokes Bouquet Spencer Jordan
• Scattered Spider Octo Tempest indictment
• Peter Stokes Northern District of Illinois
• Scattered Spider hacker extradited Finland
• Peter Stokes cybercrime complaint 25 CR 812
• Luxury jewelry retailer ransomware $8 million
• Scattered Spider Company F breach
• FBI Scattered Spider Peter Stokes
• Dual citizen Estonian US hacker arrest
• Microsoft GDID Stokes attribution
• DragonForce ransomware Scattered Spider
• Peter Stokes Tallinn Estonia cyber
• Superseding criminal complaint Stokes DOJ
• Scattered Spider 100 million ransom