Grok Build coding agent leaks confidential data from thousands of users, including SpaceXSI

Security firm Claroc found that Grok Build, the vibe-coding agent from SpaceXSI, leaks proprietary business information and other sensitive secrets from thousands of users through shareable app links. Although Grok randomizes URLs so only people with the exact link can access the data, a design decision lets anyone enumerate thousands of live projects, and clicking those links generally reveals all associated data. The exposed material includes internal business plans, ad proposals, medical exam results, cruise-line galley checklists, and employee names and ID numbers, with some of it coming from 24 apps built by SpaceXSI itself, among them a confidential onboarding plan, a sales territory map of 594 accounts, and internal system addresses for sales tools.