I Had My Agent Read All 1.3M Lines of Open-Source Grok Build. It Found That Grok Doesn't Trust Grok.

On July 14 SpaceXAI open-sourced Grok Build, its terminal coding agent, under Apache 2.0. Not the model. The harness: the CLI, the agent runtime, the tools, the TUI. It landed as a single sync commit with essentially no public git history, which is a tell of its own. So I did the obvious thing. I pointed my own coding agent at the whole repository, roughly 1.3 million lines of Rust across about 79 crates, and told it to read everything and surface the cleverest code and prompts inside. The most surprising thing it found came back as one sentence: Grok Build does not trust Grok.

Here is what that means, and it holds up across the parts nobody screenshots. The architecture assumes the AI coding agent will procrastinate, declare victory before it is done, quietly narrow its own objective, forget what it did an hour ago, damage your edits, and hallucinate tool interfaces. Then it builds an entire operating system around catching each of those failures, and the sharpest weapons in that system are prompts. That is the through-line of everything below.

The timing is the other half of the story. This trust-nothing codebase went public days after a privacy story dominated the developer feeds. A wire-level analysis reported the CLI uploading entire private git repositories, full history and .env secrets included, to a Google Cloud bucket, with an opt-out toggle that the researcher said did not stop it. That post did 534 points on Hacker News. A separate “Grok uploaded my user directory to xAI's servers” thread did another 511. The Register ran “Musk promises purge.” Then the source dropped and every user's usage limit reset on the same day.

That is the reason the teardown is worth your time: SpaceXAI open-sourced the part of Grok that doesn't trust Grok. Here is what the read turned up, most clever first.

1. Grok has an appeals court

This is the best thing in the repository.

The `/goal` autonomous mode does not let the working agent decide it has finished. Completion goes through independent, adversarial verifier agents whose entire job is to refute the claim. The default configuration can summon three of these skeptics and decide by majority. A high-confidence rejection can short-circuit the panel early; an ambiguous blocker fans it out to more judges.

The verifier prompt reads like a legal instruction to a hostile witness. It tells the judge to default to rejection when the evidence is uncertain, to treat passing tests as evidence rather than proof, to hunt for “test theater,” and to refuse any plan that has quietly narrowed the original objective. There is even an anti-ratchet rule: the verifier is forbidden from inventing brand-new requirements after its earlier objections have been fixed, because without that rule an adversarial reviewer can keep discovering fresh reasons to reject forever.