xai open-sourced its coding agent – four days after getting caught uploading developers' entire codebases

@xai published grok build's source on github on jul 15. the official framing: publishing the harness is the most direct way to make it robust, and it lets you run fully local-first against your own inference

the timing tells a different story. on jul 12 a researcher published a wire-level analysis showing grok build was bundling entire git repos – full history, committed secrets, api keys – and shipping them to a google cloud bucket. on a 12gb repo the model channel moved 192kb. the storage channel moved 5.1gb. a ~27,800x gap. the privacy toggle governed training consent, not transmission. it hit hn on jul 14. elon musk promised deletion. the code went open on jul 15

where every major lab's agent harness actually stands:

• @AnthropicAI – claude code: closed. the full source leaked on mar 31 via an npm packaging error. leaked ≠ open-sourced; the license still says all rights reserved
• @OpenAI – codex cli: apache-2.0, open since day one. the cloud agent stays closed
• @Google – antigravity cli: closed. it replaced gemini cli, an apache-2.0 project with 104k stars and 6,000+ community prs. the contributor agreement made that legal
• @Kimi_Moonshot – kimi code: mit, open from the start
• @Alibaba_Qwen – qwen code: open from the start

the pattern: nobody open-sources a harness without a reason