XAI Unveils Grok 4.5: A New Code-Centric AI Model Marred by Major Data Upload Controversy

XAI has officially launched Grok 4.5, a large language model specifically engineered for code and agentic workflows, following its acquisition of Cursor. This model, which appears to be a rebrand of Cursor’s previously teased “Composer 3,” is optimized for handling extensive codebases across multiple repositories. XAI claims Grok 4.5’s performance positions it closely to GPT-5.5 and Fable, reportedly surpassing Opus 4.8 in certain benchmarks. Beyond its capabilities, Grok 4.5 is touted for its efficiency, utilizing half the tokens per task, achieving a higher tokens per second rate, and costing less than half of comparable models, priced at $2 per million input tokens and $6 per million output tokens. Currently available via Grok Build, XAI Console, and Cursor, the model’s release in the European Union is anticipated by the end of the month.

Despite initial positive user feedback regarding Grok Build’s performance, the rollout has been marred by a significant data privacy revelation. It was discovered that the Grok Build command-line interface was, by default, uploading entire Git repositories—including private codebases and unedited secrets—to a Google Cloud bucket identified as “Grock Code session traces.” Investigations revealed uploads of up to 120GB of data, with a 12GB test repository resulting in a 5GB upload for a task that only required 200KB. XAI reportedly halted these uploads “silently” a day after an independent researcher’s wire-level analysis, implementing a server-side flag (disable Code Base upload). However, XAI has yet to issue an official statement regarding the scope of the uploads, data retention policies, or confirmation of code deletion. This practice, which defaults to uploading entire repositories for “model improvement,” has sparked widespread developer concern, emphasizing that explicit user consent via a privacy opt-out command is insufficient when sensitive proprietary data is uploaded without clear disclosure.