SpaceX AI のコーディングエージェントが全コードをアップロードする問題

There was a minor storm on social media this week after a security researcher put the increasingly-weirdly-named SpaceXAI’s Grok Build CLI behind a proxy and watched what it sent to SpaceXAI’s servers. The answer, per the researcher’s captures: the entire tracked Git repository, full commit history included, uploaded to a Google Cloud Storage bucket.

Grok Build ships with an “Improve the model” setting; turning it off did nothing to the upload. Then SpaceXAI shipped a fix, a /privacy command, and the same researcher wire-tested that too: it flips a retention flag on SpaceXAI’s servers and, in the researcher’s words, “does not change what leaves your machine.” It still uploads a ton of your code, it just promises not to hang on to it.

This made me wonder: what are the other major coding agents doing? So I went and read what their documentation actually promises about your code.

The short answer: nearly all major AI coding agents transmit at least some of your code to remote models because they have to in order to work. The important differences are how much code they send, whether it is retained or used for training, and what privacy controls you get.

Grok was uploading way too much

The Grok findings come from a researcher publishing as cereblab, who routed Grok Build CLI version 0.2.93 through mitmproxy on July 12 and published the captures, plus a full reproduction harness, on GitHub. Per the analysis:

The model-request channel moved roughly 192 KB of task-relevant traffic. A separate storage channel moved 5.1 GB, in 73 chunks, to a bucket named grok-code-session-traces. That’s about 27,800 times more data than the task required.

A fake credential the researcher planted in a .env file appeared verbatim and unredacted in the captured traffic. The researcher also cloned the git bundle out of an intercepted request and recovered a file the agent had been explicitly told not to open.

With “Improve the model” disabled, the server kept returning trace_upload_enabled: true and the upload proceeded. The toggle governs training consent, not whether code leaves your machine.

A day after publication, the same 0.2.93 binary stopped uploading. The client hadn’t changed; the server now returned a new flag, disable_codebase_upload: true. The mitigation was flipped remotely, and per follow-up coverage the upload code remains in the current binary, dormant behind that flag.

SpaceXAI responded on X rather than through a security advisory. The official account said that for teams using zero data retention, “no trace and code data is ever retained,” and pointed users to the new /privacy command. Elon Musk went further, promising prior uploads would be “completely and utterly deleted.” No independent audit of that deletion exists, and Musk is known to just say things. Cereblab’s wire test of /privacy found it toggles a single account-level retention flag while session traces continue uploading in full.

To be clear about what the evidence does and doesn’t show: the captures establish undisclosed transmission and storage. Whether SpaceXAI trained on the code or if anyone viewed it is unknown. But it made a lot of people nervous, enough that I thought it was worth looking at what everybody else does.

What code do AI coding agents actually send?

I read the current data-handling documentation for the five most popular coding agents. But first, let’s be clear; no coding agent is “local.” Claude Code, Codex, and the rest all send the files the agent reads to a remote model, because that’s how the model reads them. If you want the model to think about the code, you have to send it the code, and the model lives behind the API. The meaningful distinction is how closely scoped the data the agents transmit is to the task you gave them. Grok went way beyond what was necessary; the other agents mostly do not.

Here’s how the five agents compare on code transmission, training, and verifiability as of July 15, 2026. (Business and enterprise tiers are a different world; more on that below.)

Agent

Trains on your code by default?

Sends more than the task needs?

Verifiable from outside?

Claude Code

No (you choose at setup)

No

Partly (wire only)

Codex

Yes

No

Partly (open-source client)

Cursor

Yes

Yes (disclosed for indexing)

No

GitHub Copilot

Yes (since April 24)

No

No

Grok Build

Toggle, undisclosed default

Yes (undisclosed, now off)

Partly (wire only)

The training column is drifting over time: GitHub announced in March that from April 24, interaction data from Copilot Free, Pro, and Pro+ users, including inputs, outputs, and code snippets, trains its models unless you opt out. Business and Enterprise are exempt by contract. On individual ChatGPT plans, OpenAI’s help docs say Codex content may be used for training unless you opt out. Cursor’s data-use page is direct: with Privacy Mode off, Cursor may store and train on your codebase data, prompts, and editor actions. Privacy Mode is free for everyone and turns that off, backed by zero-retention agreements with its model providers.

Cursor’s “sends more than the task needs” entry deserves an explanation: If you enable codebase indexing, it uploads your code in chunks to compute embeddings, then discards the plaintext. That’s beyond-task transmission, but it’s disclosed, purposeful, and documented. That’s a feature, not a security incident.

Does zero data retention (ZDR) protect your code?

Zero data retention went from obscurity to top-of-mind this week. Aravind Srinivas said one of two reasons Perplexity integrated Grok 4.5 within hours was that “ZDR was available from the get go and that’s what our customers want.” But read the fine print on what ZDR actually is:

It’s an enterprise and API feature, essentially everywhere. SpaceXAI’s ZDR covers teams and API-key usage; individual Grok Build subscribers get the /privacy retention flag. Anthropic enables ZDR per organization, on request, for commercial API usage including Claude Code. OpenAI requires an approval process, and some endpoints stay ineligible even after you’re approved. If you’re an individual on a subscription plan, ZDR is not for you.

ZDR governs retention, not transmission. Your code still goes to the provider; ZDR is a promise about what happens after it arrives.

Abuse monitoring isn’t covered. Cursor’s docs note that even in Privacy Mode, prompts that trigger abuse classifiers may be stored for investigation. OpenAI’s abuse-monitoring logs may contain prompts and responses. Anthropic retains flagged content for 2 years and classifier scores for 7.

Retention windows vary wildly by plan and by settings. On Anthropic consumer plans, it’s 30 days with training off and up to 5 years, de-identified, with it on.

So nearly every coding agent receives some of your code, and on many individual plans that data may also be used for training unless you opt out. What can you do about it?

How to tighten your coding agent privacy settings

If all of this worries you, start with your privacy and training settings: Copilot’s training setting, the ChatGPT privacy portal, Cursor’s Privacy Mode, Claude’s model improvement setting, and /privacy if you ever ran Grok Build.

Five minutes each, and the defaults are not in your favor.

At Arize we built an open-source coding harness tracing plugin that instruments Claude Code, Codex, Copilot, Cursor, and Gemini CLI, and streams every session, tool call, and subagent into Arize AX. That’s a durable, per-session record of your agent’s actual behavior.

The week ended in a better place than it started. Grok Build’s upload is now off, ZDR became a feature people actually pay attention to, and there’s now a public, reproducible harness for auditing what a coding agent sends. But we are in a strange new world where everybody is constantly sending their private code to third parties, and that requires a great deal of trust. Time will tell if that trust is well-placed.

The post Is your coding agent uploading all your code? appeared first on Arize AI.