Grok Build编码智能体泄露大量机密信息，部分属于SpaceXSI。
Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Grok Build 泄露数千用户数据，包括 SpaceXSI 自身部分机密信息，如商业计划、广告提案、员工信息等。安全公司 Claroc 研究显示，泄露途径为用户分享应用的链接，因设计缺陷导致任何人可枚举数千项目。其中 SpaceXSI 自建的 24 个应用中包含机密入职计划、销售区域地图等敏感数据。
同一件事另外 3 家也报道了
- Ars Technica · AI··首发·当前阅读
Grok Build编码智能体泄露大量机密信息，部分属于SpaceXSI。
- The Decoder··+15 小时 40 分
Claroc 称超 3.5 万个 Grok 生成应用可无登录访问，含患者数据与明文密码
新增信息：ICU 患者化验值和明文密码
- IT之家 · AI··+15 小时 55 分
- 量子位··+36 小时 55 分
新增信息：员工绩效指标，包括姓名、效率和奖金
按发布时间排列 · 事件后续出现时自动追加 · 由模型根据各家标题与摘要比对
Grok Build, the vibe-coding agent from SpaceXSI, is leaking data—some of it proprietary business information and other sensitive secrets—from thousands of its users, including the very same Elon Musk-owned company that offers the platform, new research shows.
The information is revealed through links allowing Grok Build users to share their apps with others. Grok takes steps to randomize the URLs so only people who know the exact URL can access the data stored there. A design decision by developers of the platform, however, completely torpedoes that objective and makes it possible for anyone to enumerate thousands of live Grok Build projects. Except in rare cases, clicking those links opens the app and reveals all data associated with it.
You had one job
Research from security firm Claroc shows that the exposed data includes things like internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers. Ironically, some of the sensitive data comes from two-dozen apps built by SpaceXSI (the name of the now-merged SpaceX and xAI) itself. A small sampling of the documents revealed in the SpaceXSI apps—Claroc found 24 of them—include an onboarding plan, marked confidential, for a new member of SpaceXSI’s enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals.
来源: Ars Technica · AI · arstechnica.com