Skip to main content
biznesam.ai
AI Briefing

Grok silently uploaded your code, ChatGPT Work goes free

Three July events force every small business owner to check one thing — where your business data actually goes when you use an AI tool.

LV EN

Summary

  • Grok Build silently sent full code repositories to the cloud — the “privacy toggle” did nothing; only found via a security researcher’s wire-level analysis
  • ChatGPT Work is now free on every plan — after the Codex merger, small businesses get an agent that returns finished sales briefs, spreadsheets, and reports
  • A new AI model, Bonsai 27B, runs on an iPhone offline — Apache 2.0 open source, data stays on the device

Bottom line: this week puts one question in front of every small business owner — do you know where your business data goes when you use AI?

1. Grok’s coding tool silently uploaded everything

What changed. A security researcher published wire-level proof on July 10 that Elon Musk’s xAI Grok Build CLI silently uploads developers’ full Git repositories — including .env files with passwords — to a Google Cloud bucket called grok-code-session-traces. On a 12 GB test repository the task required 192 KB, while the upload was 5.1 GB. The “Improve the model” toggle did nothing — server responses still returned trace_upload_enabled: true. A day after the report went public, xAI quietly disabled the function server-side.

What this means for a small business. This isn’t a developer-only story. If you run a 5-person business and use AI tools for customer emails, invoices, or contracts, the same can happen to your data. The “Don’t improve the model” setting DOES NOT determine whether data leaves your machine. Those are two different settings. An accountant pasting a client balance sheet into ChatGPT “just to help analyze it” may not know where that data now lives.

What you can do this week.

  • Open every AI tool you use and look for a “data retention” or “zero data retention” (ZDR) setting. If it’s not there, assume everything is stored on the server
  • ChatGPT’s Business and Enterprise plans (from €25/user/month) offer ZDR — the free tier keeps data for 30 days
  • Don’t paste customer data, contracts, or financials into AI tools without ZDR enabled. Anonymize or use only general questions
  • If your team uses AI coding tools (Cursor, Grok Build, Copilot) — make sure .env files are in .gitignore and the tool isn’t uploading the whole repo to the server

What to watch.

  • Expect 2-3 more similar disclosures about other AI tools in the coming months — the scale is not going down
  • EU AI Act compliance deadlines at the end of 2026 will force AI vendors to publicly document what they do with data

2. ChatGPT Work is now free on every plan

What changed. On July 9, OpenAI merged Codex and ChatGPT into one tool — ChatGPT Work. It acts as an agent that returns finished documents, spreadsheets, and simple web apps instead of just chat replies. Available on every plan including free. OpenAI also published concrete workflows for sales teams, data analysis, and finance.

What this means for a small business. If you run a 3-10 person business and have only used ChatGPT for answers so far — you can now ask for a finished artifact. Examples from OpenAI’s write-up: a salesperson pastes a CRM export + email history and gets a prioritized prospect list with next steps. An accountant pastes 6 months of invoices and gets a report on debtors overdue by 30+ days. An agency owner pastes campaign data and gets a client-ready slide deck.

What you can do this week.

  • On the free plan, try Work mode — open chatgpt.com, new chat, pick “Agent” or “Work” at the top
  • Sales: paste a CRM export (CSV works) + last 20 emails with a customer → ask “Prepare a 15-min pitch for this account for next week’s meeting”
  • Accounting: paste an invoice spreadsheet → ask “Build a table of the top 10 overdue debtors with a suggested reminder message for each”
  • Always review the output manually — AI mistakes here are statistically normal, but business decisions stay your responsibility

What to watch.

  • The free tier will stay usage-limited; if you like the results, the Plus plan (€22/mo) raises the caps
  • Expect more Google Workspace and Microsoft 365 integrations in the coming 2-3 months

3. When AI lives on your phone, data doesn’t leave

What changed. This week Bonsai 27B launched — the first 27-billion-parameter AI model that runs on a modern phone (iPhone 17 Pro, ~6 GB memory). Based on Qwen 3.6, uses only 4 GB of storage, Apache 2.0 open source. Handles image analysis, multi-step reasoning, tool use. Retains 90-95% of the full-precision model’s accuracy.

What this means for a small business. If you worry about customer data privacy (law firms, healthcare, accounting), locally-run AI is an alternative to cloud services. A lawyer looking for a specific clause in a 50-page contract can do it right on their laptop — the document doesn’t go to OpenAI or Google. Cost is a one-off hardware purchase, not a monthly subscription.

What you can do this week.

  • If you have a Mac with an M1/M2/M3 chip or an iPhone 17 Pro — try LM Studio (free). Download a model, run it, ask questions — all locally
  • Start with a smaller model (Llama 3.2 3B or Phi 3.5) — works on any modern laptop without a GPU
  • If results satisfy and hardware allows — upgrade to Bonsai 27B or Qwen 2.5 32B
  • Practical uses: document summarization, email draft generation, internal Q&A on procedures — with no data leakage risk

What to watch.

  • Over the next 6 months local models will get smaller and faster still — by early 2027, what runs on a mid-range laptop will match today’s expensive server
  • Legal, medical, and financial-sector businesses will move to this model to solve their data regulation problem

Today’s picture

Three stories highlight one structural question: where does business data go when you use AI. The Grok incident shows AI vendors’ “privacy settings” can be a false comfort. Free ChatGPT Work expands small business capability but also raises the risk that confidential data ends up in the cloud unthinkingly. Bonsai 27B shows that locally-run AI is no longer theory — in mid-2026 it’s a real choice on existing hardware.

EventConsequence
Grok Build silently uploaded code repositoriesEvery AI tool needs its “data retention” setting checked; “don’t improve the model” ≠ “data stays”
ChatGPT Work free on every planSmall businesses get finished work artifacts (briefs, decks, reports) at no cost
Bonsai 27B runs on a phonePrivate AI use without data leakage is no longer a large-enterprise privilege

Three questions for a small business owner:

  • Which 3 AI tools does your team use daily, and does each have “data retention” turned on?
  • What’s one weekly task done manually today that ChatGPT Work could finish in agent mode?
  • Is there a data category (customers, finances, health) for which a local AI would be a better choice than the cloud?

Sources