SpaceX open-sources Grok Build. The repository is a single commit.

SpaceX released Grok Build, its AI developer build tool, as open source on Wednesday, days after the company promised to do so in response to a privacy scandal. The release lands in the same week researchers caught the tool packaging user repositories as Git Bundles and uploading them to a Google Cloud storage bucket without clear, upfront consent.

One clarification on the names: the Grok chatbot is xAI's product. Grok Build is a separate developer build/compilation tool from SpaceX, the parent company. They share a brand; they do not share a code base.

Grok Build is the kind of tool a developer pulls in to compile and ship AI-powered applications with SpaceX's models. SpaceX markets it as "fully open-sourced and local-first with your own inference," and runs a bug bounty on HackerOne paying $100 to $20,000 by severity. Until this week, none of that source was available to read.

Now it is, in one commit.

Simon Willison, the Datasette creator and Django co-creator, measured the GitHub repository at 844,530 lines of Rust. The count is large; the release is not. The repository has a single commit, no pull requests, and no git history. A developer who clones it today can read what the code does right now. They cannot read a diff, because there is no diff to read.

The data path matters. The code that originally sent user repositories to SpaceX's cloud is still present in the codebase, Willison found, but it appears altered to reverse the behavior. That is a useful piece of evidence for users wondering whether the upload mechanism was actually changed. It is also the only piece of evidence, because there is no commit history to show how or when the reversal landed, only the new state.

The release answers a narrower question than the privacy scandal asked. A license change makes the source legible. The privacy episode was about behavior: which data moved, when, and under what consent. The repository on GitHub shows the post-incident state of the code. It does not show the pre-incident state, the data that left user repos before the reversal, or the timeline of the change. Musk's statement on X promised a security audit; a single-commit dump is not one.

SpaceXAI's separate statement on the data retention side: zero data retention (ZDR) was always on by default for enterprise customers; for non-enterprise users in the early beta, retention was enabled by default; that default was disabled for all users on 2026-07-12; previously retained coding data is being deleted. The fix path is plausible, but it is a vendor statement, not an audited record.

The next check is whether anything follows the release. Pull requests would be the obvious signal that an outside reader can actually propose changes. A subsequent tagged commit, with a diff against this one, would make the reversal verifiable. A public report from the promised security audit would address the rest. None of those exist yet.

A license is not an audit. SpaceX gave developers the ability to read the code on Wednesday. It did not give them the ability to confirm what the code did last week.