Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Grok Build leaked thousands of user data, including some confidential information of SpaceXSI itself, such as business plans, advertising proposals, employee information, etc. Security company Claroc's research shows that the leakage path was users sharing links to the app, due to design flaws allowing anyone to enumerate thousands of items. Among the 24 applications built by SpaceXSI, there are sensitive data such as confidential onboarding plans and sales area maps.
Same story3 other outlets also reported this
- Ars Technica · AI··First·Reading now
Grok Build encoding agents leak a large amount of confidential information, some of which belongs to SpaceXSI.
- The Decoder··+15 h 40 min
Claroc claims over 35,000 Grok generative applications can be accessed without login, including patient data and plaintext passwords
Adds:ICU patient lab values and plaintext passwords
- ITHome · AI··+15 h 55 min
Grok Build has a security vulnerability that exposes SpaceXSI sensitive data
- QbitAI··+36 h 55 min
Grok leaks its own secrets! SpaceX Tesla salary performance exposed
Adds:employee performance metrics including names, efficiency, and bonuses
In order of publication · later reports are added as they appear · Compared by AI from each outlet’s title and summary
Grok Build, the vibe-coding agent from SpaceXSI, is leaking data—some of it proprietary business information and other sensitive secrets—from thousands of its users, including the very same Elon Musk-owned company that offers the platform, new research shows.
The information is revealed through links allowing Grok Build users to share their apps with others. Grok takes steps to randomize the URLs so only people who know the exact URL can access the data stored there. A design decision by developers of the platform, however, completely torpedoes that objective and makes it possible for anyone to enumerate thousands of live Grok Build projects. Except in rare cases, clicking those links opens the app and reveals all data associated with it.
You had one job
Research from security firm Claroc shows that the exposed data includes things like internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers. Ironically, some of the sensitive data comes from two-dozen apps built by SpaceXSI (the name of the now-merged SpaceX and xAI) itself. A small sampling of the documents revealed in the SpaceXSI apps—Claroc found 24 of them—include an onboarding plan, marked confidential, for a new member of SpaceXSI’s enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals.
Source: Ars Technica · AI · arstechnica.com