Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
1 IOC

Grok Build CLI Sent Entire Repositories and .env Secrets to xAI, Analysis Finds

Cyber Press
Cyber Press
Published July 14, 2026Original Report

Malware Families

Excerpt

A wire-level teardown of xAI’s Grok Build coding CLI (version 0.2.93) has found that the tool transmitted entire repositories, including git history and unredacted .env secrets to xAI’s cloud infrastructure, independent of what code the agent actually read. The analysis, published as a GitHub gist by independent researcher @cereblab, was corroborated by multiple outlets and used MITMProxy to intercept HTTPS traffic on macOS, and identified two distinct…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREunknownCAPABILITYRemcosVICTIMunknown
Adversary
Infrastructure
Capability(1)
Victim

Attack Flow7 steps · MITRE ATT&CK mapped

CollectionTA0009T1005
1/7
Data from Local System
ActionCollect repository data
The Grok Build CLI tool collected entire repositories, including git history and sensitive .env files, regardless of whether the agent accessed them.

Indicators of Compromise

Open the mindmap →

1 indicators

TypeIndicatorConfidenceScoreFirst Seen
MD5dc9a40bc26120f4540e4e09b75ffb547HighScore 56/100First seen

IOC Relationship Graph

Building graph…