Grok Build share link leaks tens of thousands of app data
The story so far
Security firm Claroc claims that the SpaceXSI-owned AI programming tool Grok Build has a design flaw, allowing anyone to enumerate thousands of online projects. Clicking the link opens the app and displays all its data. Claroc checked 37,571 online applications, of which 35,578 (94.7%) were accessible without login, leaking contents including ICU patient lab values, a list of over 3,500 employees from a hospital group, and 18 plaintext password accounts from a time-tracking app's source code. SpaceXSI itself was also affected: Claroc discovered that 24 employee applications exposed confidential onboarding plans, a sales region map covering 594 accounts, internal system addresses of sales tools, and ad proposals. Subsequent reports mentioned related applications for X and Tesla, including a service center rating sheet containing the names of 22 technicians, efficiency, and bonus information. SpaceXSI has taken down these 24 applications but has not addressed the public applications of other users and organizations. Claroc claims that 'anyone with the link can see' was the default setting for the paid accounts tested, and changing it to 'only me' can prevent external access; write and delete tests were only conducted on their own applications. The identifier for the share link is located before the domain name and can be publicly retrieved through passive DNS services.
AI-written from the reports · Updated 2 days ago
Coverage timeline
Follow the coverage to see every side of the story.
- QbitAIGrok leaks its own secrets! SpaceX Tesla salary performance exposed
Security company Claroc discovered over 35,000 Grok applications that can be accessed without logging in, including confidential information from companies such as SpaceXSI (the merged company of SpaceX and xAI), X, and Tesla, such as employee onboarding plans, sales customer profiles, and service center rating sheets (including the names, efficiency, and bonuses of 22 technicians).
- ITHome · AIGrok Build has a security vulnerability that exposes SpaceXSI sensitive data
Cybersecurity company Claroc discovered a security vulnerability in Grok Build, an AI programming tool under SpaceXSI, leading to the leakage of sensitive data of thousands of users, including SpaceXSI's own data. Application sharing links generated by Grok, with identifiers located in the domain name, can be publicly retrieved through passive DNS services, causing information leaks from institutions such as hospitals and fire departments, where only one application was password-protected. SpaceXSI later removed 24 applications exposing internal data but did not handle other publicly accessible applications.
- The DecoderFeaturedClaroc claims over 35,000 Grok generative applications can be accessed without login, including patient data and plaintext passwords
Security company Claroc reported that out of 37,571 Grok-generated applications still online, 35,578 (94.7%) were accessible without login. The leaked content included ICU patient lab values, a list of over 3,500 employees from a hospital group, and 18 sets of plaintext account passwords from a time-tracking application source code; another 24 applications from SpaceXSI and X employees exposed internal sales area maps and advertising proposals.
- Ars Technica · AIGrok Build encoding agents leak a large amount of confidential information, some of which belongs to SpaceXSI.
Grok Build leaked thousands of user data, including some confidential information of SpaceXSI itself, such as business plans, advertising proposals, employee information, etc. Security company Claroc's research shows that the leakage path was users sharing links to the app, due to design flaws allowing anyone to enumerate thousands of items. Among the 24 applications built by SpaceXSI, there are sensitive data such as confidential onboarding plans and sales area maps.
Heat over time
- Now
- 3
- Peak
- 2611 Nov, 22:00
- 24h change
- -76%
Hover or tap the chart to see each hour; use the arrow keys on a keyboard.