Grok Build leaks confidential data from thousands of users
Original: Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Why This Matters
AI coding agents bypassing basic access controls expose a systemic enterprise security risk.
Security firm Claroc found 35,000 Grok Build apps publicly accessible via enumerable URLs, exposing internal SpaceXSI sales docs, Navy contractor rosters, Tesla tech scorecards, and medical records from thousands of workers.
Grok Build, the vibe-coding agent from SpaceXSI (the merged SpaceX and xAI entity), has been leaking sensitive data from thousands of users — including from SpaceXSI itself. Security firm Claroc discovered the flaw: Grok Build generates shareable links meant to be obscure-by-obscurity, but a design decision in the platform made it trivial to enumerate roughly 35,000 live project URLs. Opening most links exposed all data stored in that app.
The leaked material ranges widely. Claroc found 24 apps built by SpaceXSI employees containing a confidential enterprise sales onboarding plan, a territory map of 594 accounts, internal tool addresses, and advertising proposals. Beyond SpaceXSI, exposed data included 3,784 worker medical exams from a Peruvian construction company, a Tesla service-center scorecard naming 22 technicians with bonus status, a roster of 108 people on a US Navy logistics support contract, and crew details from a luxury cruise line.
Claroc notified SpaceXSI on Sunday. Getting no response, a researcher tagged Elon Musk and Grok Manager Matt Palmer directly on X. SpaceXSI began removing its own 24 app links only after Ars Technica sent questions — not after the initial disclosure. Data from other organizations remained accessible at publication time.
"The company that makes Grok had its own internal material open to anyone holding the link," Claroc wrote, noting that any conventional SaaS tool would have required a company login.