New in September 2026: unpatched code execution from any repo you didn’t clone

On September 1, Manifold Security published GitSpawn, research covering eight findings across seven CLI coding agents. Grok Build is one of the four still unpatched at publication, confirmed on 1.0.13.

The mechanism is the same in every affected tool. Grok Build runs git at startup to work out where it is; git refreshes its index; git honours the repository’s own core.fsmonitor setting, which names a program to run. Manifold’s write-up says the payload fires “on the first keystroke, before any message is sent” — outside the sandbox, with no approval prompt, and with your privileges. The attacker gets your SSH keys, the credentials in your environment, and every repo on disk.

The delivery path is narrow but ordinary: git clone does not carry a .git/config, so a hostile GitHub URL is harmless. A zipped project folder, a shared drive, a synced folder or a dev-container image carries it fine. That is exactly how contractors and agencies hand projects over.

The disclosure record is the part that should affect your decision. An earlier report of the same class was filed with xAI on July 1 and closed as informative. Manifold’s follow-up on July 14 was closed as a duplicate of that one. It was re-confirmed reproducible on September 1. Two months, two reports, no fix. Compare Goose (reported July 13, patched in 1.44.0 with a CVE) and Claude Code’s main path (reported June 26, patched by 2.1.196).

Until xAI ships a fix: do not open a project folder with Grok Build unless you cloned it yourself. If you must, run git config --local --get core.fsmonitor in the folder first and read the whole .git/config before starting a session. Full detail in our guide, the repo someone sent you can run code before you type anything.

Rating stays at 2. It was already 2 for the July repo-upload incident below, and this doesn’t move a number that low any lower. But it is the second time in three months that Grok Build has been the tool on the wrong end of a disclosure, and the second time the company’s response was to close the report rather than fix the thing.

Correction, August 27, 2026: this page told you Grok Build was local-first. It wasn’t.

We got this badly wrong, and we’re fixing it six weeks late. Until today this page described Grok Build as “local-first,” said “your source code does not leave your machine during a session,” called it “air-gap compatible,” and recommended it to founders in regulated industries on exactly that basis. All of that was disproven publicly on July 12, 2026, and we didn’t catch it — including when we updated this page on August 21.

Here is what actually happened. AI safety researcher Cereblab published a wire-level analysis showing that Grok Build was packaging users’ entire repositories as Git bundles and uploading them to a Google Cloud Storage bucket, rather than sending only the files a task required. The uploads included full Git history, which meant secrets deleted from the repo months earlier went up too. A canary API key and database password sitting in a .env file appeared verbatim and unredacted in the captured traffic.

The detail that matters most: Cereblab ran the test with a deliberately trivial prompt, instructing the CLI to reply only with “OK” and explicitly ordering it not to open any files. It uploaded the whole repo anyway. Other users reproduced it and reported worse — one had their entire home directory, including SSH keys and a password manager database, read and uploaded.

xAI stopped the behaviour within about a day via a server-side flag, disable_codebase_upload: true, applied globally. Note what did not fix it: the /privacy command the company pointed people toward in its public response. As Cereblab put it, /privacy is a per-session retention toggle, not the switch that stopped the uploads, “and no developer should have to run an opt-out after every session to keep their own code off someone else’s servers. The right default is off.” Musk publicly promised that all previously uploaded user data would be “completely and utterly deleted”; that promise has not been independently verified by anyone.

What this changes about our recommendation. The privacy story was one of the two reasons to pick Grok Build over Claude Code or Codex. It is gone. Not because the bug is unpatched — it is patched — but because the bug revealed a default that should never have shipped, a privacy control that didn’t control the thing it was pointed at, and a company response that reached for reassurance before accuracy. The Register noted at the time that Claude Code, Gemini CLI and Codex all open individual files rather than shipping whole repos with their Git histories; this was not the industry norm, it was xAI’s choice.

If you ran Grok Build on a real codebase before July 13, treat every credential that was in that repo’s history as exposed and rotate it. Sources: The Register, The Next Web, The Hacker News. For what this means for every agent you run, not just this one, see your .env file is the first thing your coding agent reads.

New in August 2026: Grok 4.6 lands, and the price of entry is lower than we had it

Two corrections and one upgrade.

The upgrade: on August 12, SpaceXAI shipped Grok 4.6 and it is now the top engine inside Grok Build, five weeks after Grok 4.5. The gains on long agentic runs are real — DeepSWE v1.1 jumps from 54% to 65.9%, Terminal-Bench v3.0 from 15.7% to 26%, APEX-Agents from 47.1% to 57.5% — and the model is specifically post-trained to keep verifying its own work across long trajectories, which is exactly the workload Grok Build’s parallel-agent design is built around. It still trails GPT-5.6 Sol Max and Claude Fable 5 Max on most coding evals. Context window is 500K, but note the API pricing cliff at 200K tokens.

The corrections: there is no standalone Grok Build subscription, and the entry price is much lower than the $99/mo figure we previously listed. Access comes bundled with an xAI or X plan — SuperGrok at $30/mo, X Premium+ at $40/mo, or SuperGrok Heavy at $300/mo. Grok Build launched Heavy-only on May 14 and opened to the cheaper tiers ten days later; our page never caught the change. Sources: VentureBeat, xAI docs, OpenRouter.

None of this changes the verdict below. A cheaper terminal tool is still a terminal tool.

New in July 2026: Grok 4.5 becomes the flagship engine

On July 8, 2026, xAI released Grok 4.5, its first model built specifically for coding and agentic work, and it’s now the top-tier engine inside Grok Build, sitting above the original grok-code-fast-1. Musk is calling it “Opus-class”; the honest read is that it’s a genuinely strong, unusually cheap model (roughly a third the per-token cost of Opus 4.8) that’s competitive with GPT-5.5-tier coding work, though independent testing on messy production repos is still shaking out. It was trained partly on real Cursor session data, so it’s tuned for exactly the kind of long agentic runs Grok Build is built around. The upgrade makes the multi-agent and Arena Mode features more compelling (better base model, same architecture) but it doesn’t change the core verdict below: this is a terminal tool for technical builders, not a visual builder for non-coders. Note Grok 4.5 is not yet available in the EU (targeted mid-July). Sources: xAI: Grok 4.5, TechCrunch.

Elon Musk personally posted the call for beta testers on May 14, 2026, and xAI shipped Grok Build the same day. Welcome to the three-way terminal race: Claude Code, OpenAI Codex CLI, and now Grok Build. The product is in early beta, the pricing is steep, and the non-technical-founder fit is close to zero. But if you’re a technical founder or you’re building alongside engineers, it’s worth understanding what xAI built here, because Arena Mode is a genuinely different idea.

What is Grok Build

Grok Build is a command-line interface for agentic coding, the same basic category as Claude Code and OpenAI’s Codex CLI. You describe what you want in your terminal and the agent plans, searches documentation, writes code, runs tests, and iterates without constant hand-holding. The differentiators are architectural.

The underlying model is grok-code-fast-1, built by xAI from scratch with a training set focused on production-grade programming and real-world pull requests. It scores 70.8% on SWE-Bench Verified, roughly competitive with Claude Code and Codex at launch. Context window is 2 million tokens.

What makes it different

Multi-agent parallelism. Grok Build spins up to eight sub-agents simultaneously, each running the plan → search → build pipeline on its own branch of the problem. Where most coding agents tackle a complex task sequentially, one thread and one direction, Grok Build attacks from multiple angles at once. For large, multi-file projects this can mean meaningful speed and coverage gains.

Arena Mode. This is the feature getting the most attention. Instead of giving you a single solution to accept or reject, Arena Mode runs multiple agents against the same problem, has them compete, scores and ranks the outputs automatically, and surfaces the winner, all before a human reviews anything. Think of it as an internal red team built into the build loop. For quality-conscious teams tired of rubber-stamping AI code, this is a real idea, not a marketing angle.

~~Local-first.~~ Struck. We previously listed local-first design as a headline differentiator and told founders in health, finance and legal that their code stayed on their machine. That was wrong, and the July 2026 incident above is why. Grok Build was uploading whole repositories, Git history included, to xAI’s cloud storage — the opposite of the property we credited it with. The whole-repo behaviour has been switched off, but if code confidentiality is your reason for choosing a coding agent, this is no longer the tool that wins on it, and you should be evaluating vendors on zero-data-retention terms you can read in a contract rather than on marketing language about locality.

Plan Mode. Before executing, Grok Build explains what it’s going to do and gets your sign-off. This sounds minor until you’ve watched an agentic tool rewrite a dozen files in the wrong direction while you were getting coffee. Plan Mode addresses that specific failure mode.

Ecosystem compatibility. Drop Grok Build into an existing project and it picks up AGENTS.md, plugins, hooks, MCP server configs, and existing conventions without extra setup. If your team is already Claude Code–fluent, the mental model transfers.

Where Grok Build is not the right choice

This is not a tool for non-technical founders. There is no UI. There is no visual preview. There is no drag-and-drop, no generated app you can click around in, no one-click deploy. If you want to describe an app in plain English and see something working in your browser, use Lovable, Bolt, or Base44. Grok Build is for people who are comfortable in a terminal.

On pricing, see the August 2026 section above: there is no standalone Grok Build subscription and access is bundled with an xAI or X plan, starting at $30/mo on SuperGrok. That is competitive rather than eye-watering, and it is a lot cheaper than the $99–$299/mo figures this page carried for months. The model is also available via API at $0.20 per million input tokens and $1.50 per million output tokens for teams wiring Grok Build into their own pipelines.

Performance and caveats

70.8% on SWE-Bench Verified is competitive but not dominant in a field where Claude Code and OpenAI’s o3-based Codex are the benchmarks. The real story isn’t single-agent performance. It’s whether running eight agents and auto-ranking their outputs produces materially better results than running one great agent. That’s a testable claim, but the independent evals aren’t in yet. Take the marketing numbers with appropriate skepticism; Arena Mode is a plausible hypothesis, not a proven production advantage at this stage.

What is verifiable: local-first design, 2M token context, a clean Plan Mode implementation, and a reasonably fast CLI experience based on the beta reports available at launch.

Bottom line

Grok Build entered a crowded market with two genuinely interesting ideas. One of them turned out not to be true. Multi-agent parallelism with automatic output ranking is still a real, differentiated bet, and Arena Mode remains the most interesting architectural idea in the terminal-agent category. The privacy-first story is dead, and it died in a way that tells you something about how the company operates: the default shipped wrong, the control it pointed customers to wasn’t the control that fixed it, and the executive response led with reassurance.

For technical founders who want to try Arena Mode, it’s still worth a look, on a repo whose secrets you’d be relaxed about. For anyone choosing a coding agent because of confidentiality guarantees, choose something else. For non-technical founders, this was never your tool and still isn’t — stick with the visual builders.

The $99/mo intro price makes a six-month trial defensible if you’re already doing serious agentic coding work. The $299/mo standard price is harder to justify until Arena Mode proves out in independent benchmarks.

Was this helpful?