A security firm has found that Grok Build, the vibe-coding agent from SpaceXSI (the merged company of SpaceX and xAI), is leaking sensitive data from thousands of users, including confidential internal documents belonging to the company itself, because of a design flaw in how it generates sharing links.
Claroc, a security firm, reported that Grok Build's attempt to randomize project URLs so that only users with the exact link can access them is undermined by a design decision that makes it possible to enumerate thousands of live projects. Once a project is accessed, all associated data is revealed in most cases.
The exposed information includes internal business plans, advertising proposals, medical exam results, employee names and ID numbers, and a galley checklist from a celebrity cruise line. Among 24 SpaceXSI apps Claroc found, the documents included a confidential onboarding plan for a new enterprise sales team member, a sales territory map of 594 accounts, internal system addresses for sales tools, and advertising proposals.
Grok Build is a platform that allows users to build and share apps through links.
Analysis
Why This Matters
- The vulnerability exposes sensitive personal and corporate data from thousands of projects, including trade secrets and private medical information.
- It underscores the security risks in AI-assisted development platforms that prioritise ease of sharing over adequate access controls.
- The fact that SpaceXSI's own confidential documents were among the exposed data highlights the potential for even the platform's creator to be affected by its weaknesses.
Background
Grok Build is an AI-powered coding platform developed by SpaceXSI, the company formed after the merger of SpaceX and xAI. It lets users create applications and share them via automatically generated URLs. The security firm Claroc found that the randomisation of those URLs is flawed, allowing anyone to discover and access a large number of projects simply by enumerating possible URLs.
Key Perspectives
What to Watch
- Whether SpaceXSI issues a patch or changes the URL generation scheme to prevent enumeration.
- The potential for exposed data to be misused before the vulnerability is closed.
- Possible regulatory scrutiny or legal actions if affected users seek accountability.
Checked
11 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedGrok Build is leaking user data, according to new research.Ars Technica - All content: “Grok Build, the vibe-coding agent from SpaceXSI, is leaking data—some of it proprietary business information and other sensitive secrets—from thousands of its users”
- SupportedClaroc reports that a design flaw allows people to enumerate Grok Build projects.Ars Technica - All content: “Research from security firm Claroc shows that the exposed data includes things like internal business plans”
- SupportedThe exposed data includes confidential internal documents belonging to SpaceXSI itself.Ars Technica - All content: “some of the sensitive data comes from two-dozen apps built by SpaceXSI”
- SupportedGrok Build is a vibe-coding agent from SpaceXSI, the merged company of SpaceX and xAI.Ars Technica - All content: “Grok Build, the vibe-coding agent from SpaceXSI”
- SupportedThe data leak affects thousands of Grok Build users.Ars Technica - All content: “from thousands of its users”
- SupportedA design decision undermines randomized sharing URLs and makes thousands of live projects enumerable.Ars Technica - All content: “A design decision by developers of the platform, however, completely torpedoes that objective and makes it possible for anyone to enumerate thousands of live Grok Build projects.”
- SupportedIn most cases, accessing a project reveals all data associated with it.Ars Technica - All content: “Except in rare cases, clicking those links opens the app and reveals all data associated with it.”
- SupportedExposed information includes business plans, advertising proposals, medical exam results, cruise-line galley checklists, and employee names and ID numbers.Ars Technica - All content: “the exposed data includes things like internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers.”
- SupportedClaroc found 24 apps built by SpaceXSI.Ars Technica - All content: “Claroc found 24 of them”
- SupportedThe SpaceXSI app documents included a confidential onboarding plan, a sales territory map of 594 accounts, internal system addresses for sales tools, and advertising proposals.Ars Technica - All content: “include an onboarding plan, marked confidential, for a new member of SpaceXSI’s enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals.”
- SupportedGrok Build lets users build and share apps through links.Ars Technica - All content: “The information is revealed through links allowing Grok Build users to share their apps with others.”