Grok AI coding tool leaks sensitive SpaceXSI data

A flaw in SpaceXSI's Grok Build vibe-coding agent caused sensitive data to be exposed for thousands of users, security firm Claroc said, according to Ars Technica. The issue allowed links to apps to be publicly discoverable via certain DNS services, leading to leaks from a hospital group, a fire department and SpaceXSI itself.

Claroc explained that the way Grok creates links places a randomly generated four‑word phrase to the left of the domain, unlike Google’s Gemini which puts it to the right, enabling passive DNS servers to index them. The links, called GhostShares by the company, could be opened by anyone with the URL. "We were shocked," the researchers wrote in a blog post. "The company that makes Grok had its own internal material open to anyone holding the link."

The leak included an onboarding plan, a sales territory map covering 594 strategic accounts, eight advertising proposals, four live advertiser account boards and two X brand‑safety playbooks. Only one of the exposed apps required a password. Six of the affected organisations were Fortune 500 firms and 26 had over 1,000 staff, Claroc estimated that about two per cent of the material was rated high or critical. "By our estimate roughly two percent held material serious enough to rate high or critical," Claroc wrote.

Claroc shared its findings with SpaceXSI and the other affected firms, some of which acted swiftly. SpaceXSI reportedly only responded after Claroc mentioned Elon Musk and another executive on X; the company then removed 24 of its own apps but, according to Claroc, has not removed the apps belonging to other Grok users.