Case xai-api-key-github-leakModel & data leakUnited States
xAI employee leaks API key on GitHub exposing 60 private Grok models for two months
A key committed to a public GitHub repo by an xAI staffer worked against at least 60 fine-tuned and unreleased models, including grok-2.5V and models apparently built on SpaceX and Tesla data. It stayed valid two months.
HighAttack on AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- May 1, 2025
- Location
- United States
- Target
- xAI private and unreleased Grok models
- Severity
- High
- Triggered by
- xAI employee (accidental)
- Actor type
- Insider
- Reported loss
- None reported
- CVE
- None
What happened
A key committed to a public GitHub repo by an xAI staffer worked against at least 60 fine-tuned and unreleased models, including grok-2.5V and models apparently built on SpaceX and Tesla data. It stayed valid two months.
Impact: Two months of potential unauthorised access to private LLMs; no confirmed misuse
Who triggered it
Actor: xAI employee (accidental)
Attribution: Found by consultant Philippe Caturegli and GitGuardian
Motive: None (accidental commit)
How it happened
Attack vector: Secret committed to a public code repository
Root cause: No secret scanning or key rotation on employee repositories
Timeline
- GitGuardian alerts the employee
- GitGuardian alerts xAI security; key still valid
- Repository removed after reporting
Response
Repository taken down; xAI did not publicly comment
Current status: Resolved
Sources (open in a new tab)
- CO/AI getcoai.com
- Fullerton College Cybersecurity cybersecurity.fullcoll.edu
Cite this case
xAI employee leaks API key on GitHub exposing 60 private Grok models for two months. AI Threat Watch, case xai-api-key-github-leak, May 1, 2025. https://aithreat.io/cases/xai-api-key-github-leak/
Permanent link: https://aithreat.io/cases/xai-api-key-github-leak/