Intel / article

xai-org/grok-build, now open source

Source: Simon Willison
Author: Simon Willison
Date: Published Jul 15, 2026

Key takeaways · AI-distilled

Grok Build is 844,530 lines of Rust with only about 3% vendored; OpenAI's Codex is 950,933. Terminal coding agents are far larger programs than their thin chat interfaces suggest.
The repo ships tool implementations ported from rivals — Codex's apply_patch, grep_files, list_dir and read_dir, plus OpenCode's bash, edit, glob, read, , todowrite and write — credited in a third-party notices file.
The upload machinery is still in the tree: xai-grok-shell carries Google Cloud Storage bucket code and an upload_session_state() that now returns a hard-coded 'unavailable' error. Disabled, not deleted.
The prompt template instructs the model never to reveal the ; the main prompt has no such line — an inconsistency only visible because the prompt templates ship as files in the repo.
The whole codebase landed as a single commit, so the public repo shows the code but none of the history of how it was built.

Terms in this piece · Glossary

agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.
agent skill — A reusable instruction file that teaches an agent how to do one job well — the procedure, the tools, and what counts as done.
multi-agent — Using several AI agents on one problem — splitting work in parallel, checking each other, or filling different roles like planner and reviewer.
system prompt — The standing instructions a model receives before any user input — defining its role, rules, tools, and tone for the whole conversation.

Why it matters

A cautionary tale about what a coding agent can exfiltrate by default — worth reading before you run any new CLI agent in a sensitive directory, and the open-sourced is now inspectable.

Key quotes

“xAI's grok CLI tool faced severe community backlash yesterday when it became apparent that running the command in a directory could upload that entire directory to xAI's Google Cloud buckets.”

“One user reported running it in their home directory and seeing it upload "my SSH keys, my password manager database, my documents, photos, videos, everything".”

“Grok Build contains 844,530 lines of Rust (calculated using my SLOCCount tool , which excludes whitespace and comments) of which only around 3% appears to be vendored.”

“For comparison, openai/codex is 950,933 lines of Rust. Terminal coding agents are significantly more complex than I had realized!”

Read the source ↗simonwillison.net