Breachesby GlyphxAI
Disclosed May 1, 2025Unverified
xAI employee leaked API key on GitHub giving access to private Grok models
A technical staff member at xAI left a working API key in a public GitHub repository for about two months. GitGuardian said it granted access to at least 60 fine-tuned and private LLMs, including unreleased Grok models and ones apparently built for SpaceX and Tesla data.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | May 1, 2025 |
| Discovered | Jul 13, 2025 |
| Attack | Exposed data |
| Data exposed | API keys |
| Sector | AI · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
Notices filed
Other breaches at xAI
xAI sues ex-engineer accused of taking Grok trade secrets to OpenAIInsider exposed internal documents and source code.InsiderAIUSUnverifiedAug 29, 2025Grok website exposed system prompts for its AI personasAI or model exposed prompts and chats, messages and internal documents.AI or modelAIUSUnverifiedAug 18, 2025
History of this record
2025-07-14 to 2025-05-01by seedSource
On July 13, 2025 DOGE employee Marko Elez committed a script to GitHub containing a private xAI API key that allowed direct access to at least 52 xAI LLMs, including grok-4-0709. The exposure was flagged by GitGuardian. to A technical staff member at xAI left a working API key in a public GitHub repository for about two months. GitGuardian said it granted access to at least 60 fine-tuned and private LLMs, including unreleased Grok models and ones apparently bby seedSource
DOGE staffer published private xAI API key on GitHub to xAI employee leaked API key on GitHub giving access to private Grok modelsby seedSource
2025-07-15 to 2025-07-14by seedSource
empty to 2025-07-13by seedSource
KrebsOnSecurity reported that a DOGE special government employee published code on GitHub containing a private xAI API key that gave access to dozens of xAI models including Grok; the key was not immediately revoked. to On July 13, 2025 DOGE employee Marko Elez committed a script to GitHub containing a private xAI API key that allowed direct access to at least 52 xAI LLMs, including grok-4-0709. The exposure was flagged by GitGuardian.by seedSource
First recordedby seedSource
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.