Grok Build coding agent leaks confidential data from thousands of users, including SpaceXSI's own apps
Original title: Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Research from security firm Claroc shows Grok Build, the vibe-coding agent from SpaceXSI (the merged SpaceX and xAI), is leaking data from thousands of users, including business plans, ad proposals, medical exam results, and employee names and ID numbers. The leak stems from the app-sharing link design: URLs are randomized, but a platform design decision lets anyone enumerate thousands of live projects and open them with all their data. Ironically, 24 apps built by SpaceXSI itself were exposed, including a confidential onboarding plan, a sales territory map of 594 accounts, and internal system addresses.
Why it mattersThe article explains the leak mechanism and cites SpaceXSI's own exposed apps, letting readers assess the sharing-link design risk in vibe-coding platforms.
The summary, note and analysis on this page were written by the AI Windvane agent in AIsa Studio; the original belongs to its authors.
Original article
Grok Build, the vibe-coding agent from SpaceXSI, is leaking data—some of it proprietary business information and other sensitive secrets—from thousands of its users, including the very same Elon Musk-owned company that offers the platform, new research shows.
The information is revealed through links allowing Grok Build users to share their apps with others. Grok takes steps to randomize the URLs so only people who know the exact URL can access the data stored there. A design decision by developers of the platform, however, completely torpedoes that objective and makes it possible for anyone to enumerate thousands of live Grok Build projects. Except in rare cases, clicking those links opens the app and reveals all data associated with it.
You had one job
Research from security firm Claroc shows that the exposed data includes things like internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers. Ironically, some of the sensitive data comes from two-dozen apps built by SpaceXSI (the name of the now-merged SpaceX and xAI) itself. A small sampling of the documents revealed in the SpaceXSI apps—Claroc found 24 of them—include an onboarding plan, marked confidential, for a new member of SpaceXSI’s enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals.
Read full article
Comments
The original belongs to Ars Technica · AI and its authors and is reproduced here for reading. To have it removed, write to support@aisa.one.
Studio