xAI dropped the full source code for Grok Build, its terminal-based coding agent, on GitHub on July 15, 2026. The release lands under an Apache 2.0 license, and it arrives days after the tool got caught vacuuming up entire code directories to Google Cloud.
The framing from xAI is generosity. Reset the usage limits, give away the harness, let people run it locally. The timing tells a different story.
What actually happened first
Before any of this, users noticed that running the grok command in a directory could upload that whole directory to xAI's cloud buckets. One user reported watching it push their SSH keys, password manager database, documents, and photos, according to Simon Willison's writeup. Not a subtle bug.
Elon Musk responded that all data uploaded before the fix would be deleted. xAI said it disabled default retention for all users starting July 12th and is deleting previously retained coding data. So the open-source move is less a gift than a cleanup, dressed as a gift.
The privacy pitch
Here's the actual selling point, and it's a real one. You can compile Grok Build yourself, point it at local inference through a config.toml file, and run the whole thing without your code ever touching xAI's servers. For anyone working on proprietary or regulated codebases, that matters more than any feature.
xAI's own thread put it plainly:
"With all retained data deleted, retention default off, and an open-source harness, we are offering complete user privacy."
Complete privacy is a strong phrase from a company whose tool was uploading password databases a week ago. The local-first path is genuine, though. Willison flagged that remnants of the Google Cloud upload code still sit in the repo at upload/gcs.rs, now disabled, with the session upload function hard-coded to return an unavailable error. Disabled, not deleted. Worth watching.
A surprisingly large pile of Rust
The codebase is bigger than you'd guess. Willison ran his line counter and got 844,530 lines of Rust, only about 3% of it vendored. For scale, OpenAI's Codex sits around 950,933 lines. Terminal coding agents are just heavier machines than they look from the outside.
The release includes the agent loop that handles context assembly and tool dispatch, the read-edit-search-execute tools, the terminal UI with inline diff viewing and plan review, and the extension layer for skills, plugins, hooks, MCP servers, and subagents. There's also a self-contained terminal renderer that draws Mermaid diagrams using Unicode box characters, which is a nice touch nobody asked for.
One odd wrinkle: the subagent system prompt instructs the model not to reveal its own contents, while the main prompt has no such rule. Small thing, but the kind of detail open-sourcing exposes whether you meant to or not.
Can you actually contribute?
Sort of. The repo currently has a single commit, so there's no development history to learn from. And while the license is Apache 2.0 and the code is readable, xAI isn't clearly set up to accept forks and pull requests as a working project. It reads more like a code dump for auditing than a living open-source effort. Which, given why it happened, is roughly what you'd expect.
The code and docs are live now on GitHub under xai-org/grok-build. If you handle sensitive repos, the honest move is to read the tools crate before you let this agent run shell commands anywhere near them.
