Kun Chen@kunchenguid
it's shocking that some people in the comment section actually tried to defend and justify Grok Build silently uploading people's entire codebases and credentials
let me summarize the key arguments and my responses
1. "everyone else is doing it"
umm.. no?? this is an absolute outlier. there isn't a single mainstream harness that proactively uploaded entire codebases wholesale, including files not required to process your prompt, and including files that contain credentials, without explicit user consent
people who say this have a low-resolution understanding that "AI apps use your data" and likely know nothing beyond that
and even putting facts aside, what kind of logic is that? if you walked into a neighborhood and you see someone using drugs, then it's okay to use drugs?
we have laws and regulations that defined what's okay. what grok did violated GDPR, CCPA, FTC Act, and potentially HIPAA, GLBA and many other regulations in various jurisdictions
2. "you agreed with their TOS which allowed them to do this"
umm.. no?? go read their TOS - what we agreed with says they can collect data directly from our prompts. what they are doing now is far beyond that
it's funny people who use this argument often didn't read or comprehend what's really covered by their TOS. again, low-resolution understanding that "TOS gives them the rights to do everything" - no it doesn't
3. "just get over it. your data is not that valuable"
umm.. no?? if it's not valuable it will not get collected. also, whether i consider my data valuable or not is up to me and me alone, not every random company
a lot of my code is open source with MIT - i already shared what i want to share. i'm not going to "get over it" and share my production credentials to a 3rd party private server who may very well leak it to god knows where
we also have moral standards and expectations. if we start to normalize and accept this kind of behavior, we will eventually live in a world where our TV may be watching us, and our bathroom mirror may have a camera and microphone. is that a world you want to live in?
i don't, hence i'm voting with my feet - i was considering buying the $300/month plan and now i'm not
it's going to be a tough long road for xAI to repair this damage in user trust. my recommendation:
- immediate public apology acknowledging the misstep. don't call it a bug, an accident, or something unintended. it was a bad but deliberate decision, so call it what it is
- be transparent about why that decision was made, and what's being done systematically in the organization to prevent similar decisions from being made ever again
- cursor should make a public statement asap to clarify whether and how it's separate from this practice. people are starting to worry whether cursor will do the same given the acquisition. if cursor is clean and can stay clean, make it clear, and xAI should consider doubling down on Cursor as the more trusted brand to deliver the value of the Grok model
