Grok Build coding agent leaks confidential data from thousands of users
Start here
Security firm Claroc found that Grok Build, the vibe-coding agent from SpaceXSI, exposes proprietary business information and other sensitive secrets from thousands of users through shareable app links. Grok randomizes URLs so only people with the exact link can reach a project, but Claroc says a design decision lets anyone enumerate thousands of live projects, and opening those links generally reveals all associated data. The exposed material includes internal business plans, ad proposals, medical exam results, cruise-line galley checklists, and employee names and ID numbers. Claroc says 24 of the affected apps were built by SpaceXSI itself, among them a confidential onboarding plan, a sales territory map covering 594 accounts, and internal system addresses for sales tools.
Generated from reports · updated 21 h ago
Report timeline
Follow the reports to see the event from different sides.
- Ars Technica · AIPicksGrok Build coding agent leaks confidential data from thousands of users, including SpaceXSI
Security firm Claroc found that Grok Build, the vibe-coding agent from SpaceXSI, leaks proprietary business information and other sensitive secrets from thousands of users through shareable app links. Although Grok randomizes URLs so only people with the exact link can access the data, a design decision lets anyone enumerate thousands of live projects, and clicking those links generally reveals all associated data. The exposed material includes internal business plans, ad proposals, medical exam results, cruise-line galley checklists, and employee names and ID numbers, with some of it coming from 24 apps built by SpaceXSI itself, among them a confidential onboarding plan, a sales territory map of 594 accounts, and internal system addresses for sales tools.
Heat for this event
Not enough continuous observations yet to draw a trend.