Loading story…
X owner Elon Musk said the company plans to publish the platform’s entire codebase with no exceptions after completing an internal security vulnerability review. The move would expand earlier transparency efforts in which X released parts of its recommendation systems, including code tied to the "For You" feed, and is being presented as a way to improve public visibility into how the platform operates.
X also said independent third-party reviewers would be asked to verify that the code released publicly matches the software running in the company’s live production environment. Reports said the initiative is intended to help rebuild trust and allow outside scrutiny of recommendation logic and potential algorithmic bias, but no timeline, repository details, or contribution process has been announced.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Alongside the planned code release, X said independent third-party reviewers or auditors would verify that the publicly released source matches the code running in its live production environment.
Elon Musk announced that X plans to publish its entire codebase with no exceptions as part of a broader transparency push. He said the release would happen only after an internal security vulnerability review is completed.
Before the new full-codebase plan, X had already released parts of its recommendation algorithm, including code related to the "For You" feed, as part of earlier transparency efforts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elon Musk’s X has asked the U.S. Federal Trade Commission to terminate or substantially modify a May 2022 consent order that governs the company’s data security and privacy practices. The FTC has opened a 30-day public comment period on the petition, which would end oversight roughly 16 years early if granted. X argues the order applies to a corporate structure and personnel from the pre-acquisition Twitter era, imposes about **$17 million** in compliance costs, and diverts engineering resources from artificial intelligence development. The 2022 order followed FTC findings that Twitter used phone numbers and email addresses collected for multifactor authentication to support personalized advertising, and it extended an earlier 2011 order imposed after two hacking incidents required the company to strengthen cybersecurity controls. X cited a 2024 California court dismissal of related class-action claims as support for its position that the disputed data use was permitted under Twitter’s terms, while acknowledging that a previous attempt to escape the order was rejected by a federal judge in 2023 on procedural or venue grounds.
Jun 29, 2026
French prosecutors raided **X’s Paris offices** as part of a criminal investigation led by the Paris prosecutor’s cybercrime unit with support from France’s National Gendarmerie and **Europol**. Authorities said the probe—opened in **January 2025** after complaints from French officials—covers allegations including **fraudulent/automated data extraction**, **tampering with automated data processing systems**, and potential **organized manipulation of X’s recommendation algorithms**, including concerns about possible influence by foreign actors. Prosecutors also summoned **Elon Musk** and X executive **Linda Yaccarino** for **voluntary interviews** in Paris in April, and called additional employees as witnesses; no charges or arrests were reported at the time of the search. The investigation expanded to include X’s AI chatbot **Grok**, following complaints that it facilitated or generated illegal content, including **sexually explicit deepfakes** (including alleged depictions of minors), **Holocaust denial** content, and alleged complicity in the **possession/distribution of child sexual abuse material (CSAM)**, alongside allegations of operating an illicit online platform. UK regulators also opened parallel scrutiny: the **ICO** launched a formal investigation into X and Grok over potential generation of nonconsensual sexualized images (including of children), and **Ofcom** had previously announced its own inquiry into related concerns. Separately, European policy pressure on youth social media access continued, with the Netherlands considering a higher minimum age and stricter platform oversight, but that debate is distinct from the French criminal case.
Jun 29, 2026
xAI's Grok Build coding CLI was found uploading users' entire tracked Git repositories to an xAI-controlled Google Cloud Storage bucket, including full commit histories, unread files, and sensitive data such as tracked `.env` contents and previously deleted secrets. Researcher **cereblab** said the behavior occurred even when the tool was asked not to open files and only return a simple response, and demonstrated the scope by intercepting an upload bundle that contained a planted canary file and complete repository history rather than only files needed for the coding task. Following public disclosure, xAI reportedly disabled the behavior server-side by setting flags including `disable_codebase_upload: true` and `trace_upload_enabled: false`, while Elon Musk said previously uploaded user data would be deleted. xAI said enterprise zero-data-retention users were not affected and that consumers could use `/privacy` to disable retention and delete synced data, but the researcher argued the real fix was the silent global flag change and noted upload code remained present in later client builds behind server-side controls, leaving unanswered questions about default data collection, retention, and the number of affected users.
Jul 20, 2026