Update — 2026-07-14: This is the original wire-level analysis (grok 0.2.93). Since publishing: xAI disabled the upload server-side (
disable_codebase_upload: true); added a/privacy opt-out— which I wire-tested and found to be a data-retention setting, not a block on what's sent; and Elon Musk publicly committed to deleting all previously-uploaded data (not yet confirmed complete). Full, maintained story + evidence: https://cereblab.com · https://github.com/cereblab/grok-build-exfil-repro
By @cereblab — Independent AI Safety Checker. Reproduce it yourself: github.com/cereblab/grok-build-exfil-repro
*A measured, reproducible teardown. Findings are backed by captured artifacts (endpoint, HTTP method, status code, byte size, host) and repro commands; where an observation was seen live but not retained as a file, §7 says so expli