Your coding agent needs a data boundary, not just a permission prompt

A coding agent can look like a local tool while quietly depending on cloud infrastructure. That distinction became painfully visible in testing of Grok Build CLI.

An independent researcher reported that version 0.2.93 packaged an entire Git repository, including its history, and uploaded that bundle to cloud storage. The test used network interception and a planted file to check what left the machine. According to the report, the canary file could be recovered from the captured bundle even though the agent had not been asked to read it.

xAI’s public changelog later documented a fix preventing full-home-directory scans when the home directory is a Git repository. That does not validate every detail of the independent report, but it confirms that directory scope was broad enough to require correction.

The careful reading matters. This is evidence from a specific consumer setup and version, not proof that every Grok Build user had every file uploaded. The public evidence also does not establish that xAI employees viewed the data, how long bundles were retained, or what happened to bundles created before mitigation.

Still, the operator lesson is bigger than one vendor.

Command permissions do not define collection scope

Teams are adopting coding agents as if they were smarter text editors. They are software operators with access to source code, shell commands, credentials, configuration files, local histories, and sometimes production systems.

A permission dialog for one command does not answer a more basic question: what context is collected before the command runs?

Git makes this especially easy to misunderstand. A repository is not only the files visible in the current folder. Its history can contain deleted secrets, old configuration, customer names, internal URLs, and code that no longer appears in the working tree. A clean .gitignore is not a reliable boundary for material already committed in history.

The practical analogy is giving a contractor access to one room while a moving company quietly boxes up the whole building. The contractor’s task permissions may be narrow, but the collection boundary is not.

Build an agent data policy before rollout

Operators do not need another generic AI policy. They need a small set of controls that can be tested.

Test the tool with canary data

Run new coding agents in a disposable repository with planted files and observe network traffic. Check what is uploaded during setup, indexing, inference, and ordinary use.

Do not assume a privacy toggle about model training also disables operational uploads. Training, inference, indexing, telemetry, and support retention are separate data paths.

Isolate the workspace

Use containers, virtual machines, or dedicated worktrees containing only the files needed for the task. Never launch an unfamiliar coding agent from a home directory, monorepo root, or folder containing unrelated projects.

Isolation also makes the result easier to inspect. If the tool sees five files instead of fifty thousand, both its behavior and its blast radius become clearer.

Keep secrets outside reachable files

Use short-lived credentials, secret managers, scoped environment injection, and automatic scanning. Remember that Git history may still contain material removed from the current checkout.

Rotating a secret after an incident is useful. Preventing the agent from reaching it in the first place is better.

Ask vendors precise questions

Require vendors to document collection scope, encryption, retention, deletion, regional storage, subprocess behavior, and enterprise controls. “We do not train on your data” is not a complete answer to what leaves the machine.

The useful question is operational: which files are transmitted, for what purpose, for how long, and under which settings?

Prepare an incident path

If a tool uploads more than expected, teams need to know how to revoke tokens, rotate credentials, identify affected repositories, preserve evidence, and pause deployment. Assign an owner before rollout. A vague escalation channel is not a response plan.

The operator takeaway

The real buying question for coding agents is no longer only which model writes the best code. It is which operating boundary you can verify.

Pilot the tool in an isolated workspace. Plant canary data. Watch the network. Document what leaves the machine. Keep credentials and unrelated repositories out of reach. Then decide whether the productivity gain justifies the remaining exposure.

Speed is useful. Invisible collection is not.