Grok Build, a vibe-coding agent developed by SpaceXSI, is leaking confidential business information and sensitive secrets from thousands of users, including internal documents belonging to Elon Musk’s own company, according to new research.
Flawed URL Design Exposes Data
The security lapse stems from the links that Grok Build generates to allow users to share their applications with others. Although the platform randomizes URLs to restrict access to those with the exact link, a design flaw allows anyone to enumerate thousands of active Grok Build projects. Clicking these discovered links typically opens the application and exposes all associated data.
Exposed Internal Documents and Response
Security firm Claroc revealed that the compromised data encompasses internal business plans, advertising proposals, medical exam results, cruise line checklists, and employee identification details. Notably, Claroc identified two dozen apps created by SpaceXSI itself that leaked sensitive material, including a confidential onboarding plan for a new enterprise sales team member, internal system addresses, and sales territory maps.
Claroc reported that the company behind Grok had its own internal material exposed without requiring sign-in authentication. After Claroc notified SpaceXSI of the privacy vulnerability and escalated the issue on X by tagging Elon Musk and Grok Manager Matt Palmer, the company began removing the exposed links. By the time the research was published, the 24 SpaceXSI apps returned an error message indicating the apps could not be found.
