A former xAI engineer has sued the company and SpaceX, alleging he was fired days before he was due to present AI-safety findings to leadership. The complaint in Devin Kim v. X.AI Corp. and Space Exploration Technologies Corp. was filed on June 9, 2026 in Santa Clara Superior Court as case 26CV495445. The retaliation claim itself remains an untested allegation, but it lands on top of a verified record: Canada's Privacy Commissioner ruled in June that Grok's image-generation tool launched without proper safeguards and violated federal privacy law.
Key facts
- The complaint was filed June 9, 2026 in Santa Clara Superior Court, case 26CV495445, by the firm Sanford Heisler Sharp McKnight. Complaint PDF.
- Kim joined xAI in April 2024 as a Member of Technical Staff, was one of the initial hires, reported to Elon Musk, and was fired on September 15, 2025, according to the filing.
- Canada's Office of the Privacy Commissioner found on June 11, 2026 that X Corp. and xAI violated federal private-sector privacy law and called the matter "well-founded" and unresolved. OPC findings.
- SpaceX's own SEC filing lists Grok's less constrained modes as presenting heightened risk of explicit content, misinformation, exploitative imagery and discriminatory content.
Start with what is on the docket, because that is the part that does not depend on anyone's characterization. The complaint says Kim was among xAI's first hires, that his supervisor was Jimmy Ba, and that he was terminated shortly before a scheduled presentation of AI-safety findings to company leadership. A widely circulated version of this story spells the supervisor's name "Jimmy Barr," which is wrong, and dates Kim's start to early 2024 rather than April.
Then come the allegations, which is what the rest of the filing is. Kim alleges he repeatedly warned that Grok's weak guardrails could enable discriminatory outputs, misinformation and dangerous misuse, that his supervisor rejected proposals for stronger testing and safety processes, and that the supervisor remarked "AI will kill us all anyway." Those are pleadings written by one side's lawyers. No court has assessed them, xAI has not answered publicly, and readers should hold them accordingly.
What makes the case worth reporting despite that is the backdrop, which is documented by parties with no stake in the lawsuit. On June 11, 2026, Canada's Office of the Privacy Commissioner published findings concluding that Grok's image-generation tool had been launched without proper safeguards, that X Corp. and xAI had violated Canada's federal private-sector privacy law, and that the companies had not demonstrated their safeguards were effective enough to fully mitigate the problem. The regulator classified the complaint as well-founded and unresolved, which in the OPC's vocabulary means the finding stands and the fix does not yet satisfy them.
Separately, the Center for Countering Digital Hate estimated in January that Grok generated roughly 3 million sexualized images across an 11-day window, including about 23,000 depicting children. The report is explicit that these figures are extrapolated from a 20,000-image sample rather than counted directly, and that distinction matters for anyone repeating them.
Most tellingly, SpaceX's own securities filings treat this as a material risk rather than a public-relations problem. Its June 2026 filing says its AI and social-media activities expose it to risks from harmful, misleading or illegal content, accuracy, misinformation and deepfakes, and that less constrained Grok modes present heightened risks including explicit content, misinformation, exploitative imagery and discriminatory content. A May 2026 SEC response letter shows staff quoting Musk's own statement that xAI was "not built right the first time around" and was being "rebuilt from the foundations up."
That is an unusual configuration. A company can dismiss a plaintiff's characterization of its safety culture. It is harder to dismiss its own risk disclosures, filed under penalty of securities law, describing the same product surface in similar terms.
The honest caveat is worth stating twice: none of the corroborating material proves the retaliation claim. A regulator finding inadequate safeguards is not evidence that a specific engineer was fired for warning about them. Those are separate questions and the second one is for a court. One widely repeated detail should also be dropped entirely, that all eleven xAI co-founders departed by the end of March. The SEC comment letter references news reports of co-founder departures without establishing any count or deadline, and no primary source supports the specific claim.
For security teams the practical relevance is narrower than the headline and more useful. This is the second story in a month about xAI shipping capability ahead of controls, after the finding that its agent product ships with standing logins to users' email and CRM systems. Standing credentials and weak generation guardrails are different failures with the same root: a deployment posture that treats safeguards as something to add after launch. A regulator has now put that in writing.
Originally published on Ground Truth, where every claim is checked against the primary source.
