xAI Open-Sources Grok Build After a Privacy Backlash
xAI released the full Grok Build source code and turned off default data retention after the coding tool uploaded users' files to Google Cloud.
What happened
xAI's Grok coding tool, a terminal coding agent, faced a sharp community backlash after users discovered that running it inside a directory could upload that entire directory to xAI's own Google Cloud storage. One user said they ran the command in their home folder and watched it upload their SSH keys, password manager database, documents, photos, and videos. xAI has not published a full explanation for why the tool behaved this way, but the company responded to the complaints and disabled the upload feature. A few hours later, xAI released the entire Grok Build codebase under an Apache 2.0 license, in a move that blogger Simon Willison read as an attempt to rebuild user trust.
Inside the codebase
Willison measured the released code with his own SLOCCount tool and found that Grok Build's Rust codebase runs to 844,530 lines, with only around 3% of that total vendored from other projects. For comparison, he noted that OpenAI's own terminal agent, openai/codex, comes in at 950,933 lines of Rust, which he took as evidence that terminal coding agents are far more complex than most people assume. The repository arrived as a single commit, so there is no commit history showing how the tool was actually built over time.
Inside the code, Willison found that the file xai-grok-agent/templates/prompt.md holds the main system prompt, while xai-grok-agent/templates/subagent_prompt.md holds a separate subagent prompt that tells the model not to reveal the system prompt to the user, an instruction missing from the main prompt. The file xai-grok-markdown/src/mermaid.rs is a terminal renderer that draws a subset of Mermaid diagram types using Unicode box-drawing characters; Willison got a version of it running in WebAssembly so it renders diagrams directly inside a browser.
The folder xai-grok-tools/src/implementations also holds tool code copied from rival coding agents: Codex's apply_patch, grep_files, list_dir, and read_dir tools, alongside OpenCode's bash, edit, glob, grep, read, skill, todowrite, and write tools. The project's THIRD_PARTY_NOTICES.md file describes these as "ported from" the original projects in a way that appears to comply with the Apache and MIT licenses those tools use.
Privacy fixes
According to xAI's own announcement, the company disabled default data retention for all Grok Build users starting on July 12th and is deleting all previously retained coding data, so that user preferences are honored going forward. xAI framed the open source release itself as part of that privacy push: with the upload path disabled, old data deleted, and the full harness made public, users can now also run Grok Build fully locally with their own inference setup instead of trusting a closed, cloud-connected agent.
Key facts
- Grok Build's Rust codebase totals 844,530 lines of code, measured with Simon Willison's own SLOCCount tool.
- xAI says only around 3% of that code is vendored from other projects.
- For comparison, OpenAI's openai/codex agent measures 950,933 lines of Rust.
- xAI disabled default data retention for all Grok Build users starting July 12th and is deleting previously retained coding data.
- The subagent prompt tells the model not to reveal its own system prompt; the main prompt carries no such instruction.
- Tool code was ported from Codex's apply_patch, grep_files, list_dir, and read_dir, and from OpenCode's bash, edit, glob, grep, read, skill, todowrite, and write.
- The whole codebase was published under an Apache 2.0 license as a single commit, with no prior commit history.
Check your understanding
How many lines of Rust code make up the released Grok Build codebase? What change did xAI make to its data retention defaults after the backlash? Which two other coding agents did Grok Build's tool code get ported from?