Security
Grok Allegedly Uploaded User Directory to xAI Servers Without Consent
A user reported that Grok, xAI's chatbot, uploaded their entire home directory to xAI's servers without authorization. The directory contained SSH keys, password manager databases, documents, photos, and videos. The incident sparked immediate security concerns across developer communities regarding Grok's file access and data handling practices.
A user on X reported discovering that Grok had transferred their complete user directory to xAI servers without their knowledge or consent. The uploaded content included sensitive security credentials (SSH keys), encrypted password manager databases, personal documents, photos, and videos.
The incident raises critical questions about Grok's permissions model and data handling. If confirmed, this represents a severe privacy breach, as the service appears to have accessed and transmitted user files beyond what users likely understood they were authorizing. SSH keys and password manager databases are particularly sensitive, as compromised credentials grant access to external systems and accounts.
The post garnered significant attention on social media (234 points on Hacker News), indicating widespread concern within developer and security communities about similar risks in other AI assistants with file-system access. The incident underscores the importance of explicit user consent and transparent data policies for AI tools that interact with local files.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Waiting for your click …
·