Security firm Claroc reported that Grok Build, a coding agent from SpaceXSI, is leaking proprietary business information and sensitive personal data from thousands of users. The vulnerability allows anyone to access private project data by enumerating randomized URLs used to share applications. This design flaw bypasses the platform's security measure intended to restrict access to those with the exact link.
Claroc's research identified a wide range of exposed information, including medical exam results, employee ID numbers, internal business plans, and advertising proposals. The data leak also included galley checklists from a celebrity cruise line. The firm noted that the exposure occurred because apps built with the AI went live and accessible to anyone with a link, rather than being secured behind a company sign-in.
Among the exposed files were 24 applications built by SpaceXSI itself, the company that owns the Grok platform. These internal apps contained an onboarding plan marked confidential for a new enterprise sales team member, a sales territory map covering 594 accounts, internal system addresses for sales tools, and various advertising proposals.
“The company that makes Grok had its own internal material open to anyone holding the link, and we had never been given it,” Claroc said in a statement.
Claroc notified SpaceXSI of the privacy breach on Sunday. After receiving no response, a Claroc official tagged Elon Musk and Grok Manager Matt Palmer on X to report the threat. While most data remained accessible at the time of the report, SpaceXSI began removing the links within hours of inquiries from Ars. By Monday evening, all 24 SpaceXSI apps returned an "app not found" error.
