A security vulnerability in SpaceXSI’s Grok Build coding agent exposed sensitive internal data from thousands of users, including SpaceXSI itself. As reported by Engadget, security firm Claroc discovered that the system’s method for handling application links permitted passive Domain Name System (DNS) services to publicly expose confidential files.
Flawed Link Generation Mechanics
The leak stemmed from how Grok Build structured web addresses for its generated applications. Although the tool constructed links using four-word random phrases known as “dice words” offering up to 38 bits of entropy, it positioned this unique identifier to the left of the domain name instead of placing it to the right, as platforms like Google’s Gemini do. This structural setup allowed passive DNS servers to record the web addresses into publicly searchable databases.
Claroc dubbed these publicly accessible pages “GhostShares,” as unauthorized individuals could discover and view them without ever receiving an invitation. Security researchers from the firm highlighted the oversight, writing in a blog post, “We were shocked,” and adding that “The company that makes Grok had its own internal material open to anyone holding the link.”
Exposed Files and Impacted Organizations
The exposed data affected a fire department, a hospital group, six Fortune 500 corporations, and 26 businesses employing more than 1,000 workers. Claroc reported that “By our estimate roughly two percent held material serious enough to rate high or critical,” noting that only one exposed application required password authentication.
Compromised internal documents belonging to SpaceXSI included an employee onboarding plan, a sales territory map detailing 594 strategic accounts, eight X advertising proposals, four live advertiser account boards, and two copies of an X brand safety playbook.
Upon being notified by Claroc, several affected organizations acted quickly to resolve the vulnerability. SpaceXSI reportedly did not respond until researchers tagged Elon Musk and another company official on X. SpaceXSI subsequently disabled 24 of its own exposed applications, though Claroc noted the company has not taken similar action for exposed applications belonging to other Grok users and external organizations.
