Grok Build coding agent leaks confidential data from thousands of users

Summarised from 3 outlets · Updated 11 Nov, 19:02 · Archive

Grok Build, SpaceXSI's coding agent, leaked sensitive information from thousands of users, including SpaceXSI itself.

Grok Build, a coding agent from SpaceXSI (formed from the merger of SpaceX and xAI), has exposed sensitive data from thousands of users through a design flaw in how it shares applications. Security firm Claroc discovered that apps published on the platform could be found and accessed by anyone, despite being intended to be private.

Users create apps by describing what they want in a chat interface and publish them with a unique web address using four random words, designed to prevent people guessing the location. However, Claroc found that these addresses can be discovered through passive DNS servers that collect publicly available domain information. The researchers identified between 35,000 and 43,601 exposed apps under the grok.me domain.

When users publish an app, they are offered three privacy options: 'Anyone with the link', 'Invited Users', and 'Only You'. But Claroc found that almost all exposed apps—94.7 per cent—could be accessed without any password or authentication required.

The leaked data includes internal business plans, medical exam results, employee names and ID numbers, and information from hospitals and fire departments. Ironically, SpaceXSI's own apps were among those compromised. The researchers found 24 SpaceXSI apps containing confidential materials including an onboarding plan for a sales team member, a sales territory map of 594 accounts, internal system addresses and eight X advertising proposals.

Claroc notified SpaceXSI of the issue on Sunday. The researchers found that six other exposed companies were in the Fortune 500 list, and 26 had more than 1,000 employees. Only around two per cent of exposed apps contained material serious enough to warrant a high or critical severity rating. The flaw stemmed from how Grok Build created links, placing the random identifier to the left of the domain rather than to the right, as Google's Gemini does, making them discoverable by passive DNS servers.

How it is being reported

• Elon Musk's Grok Build coding agent is leaking a serious amount of confidential dataDefault Grok Build options are wreaking havoc again - and even SpaceXSI wasn't safe from its own configurations.TechRadar · 11 Nov, 17:15
• A Grok vibe-coding agent leaked sensitive SpaceXSI dataA flaw in SpaceXSI's Grok Build vibe-coding agent allowed sensitive data to leak from thousands of users including... SpaceXSI.Engadget · 11 Nov, 12:35
• Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSIResearcher finds 35,000 Grok Build apps wide open to anyone who looked for them.Ars Technica · 10 Nov, 21:12

In this story: SpaceXSI · Grok Build · Claroc · Elon Musk · SpaceX · xAI · Google

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem · Corrections log