Grok Build coding agent leaks confidential data from thousands of users, including SpaceXSI

Research from security firm Claroc shows that Grok Build, the vibe‑coding agent offered by SpaceXSI, is leaking confidential information from thousands of its users, including the SpaceXSI company itself, new research reveals.

The platform creates randomised URLs so that only people who know the exact link can access an app, but developers’ design decision allows anyone to enumerate thousands of live Grok Build projects. In most cases, clicking a discovered link opens the app and displays all data stored within it, according to Claroc.

The exposed material includes internal business plans, advertising proposals, medical exam results, galley checklists from a celebrity cruise line and employee names and ID numbers. Claroc identified 24 apps belonging to SpaceXSI that contained sensitive documents such as a confidential onboarding plan for a new enterprise sales hire, a sales‑territory map covering 594 accounts, internal system addresses for sales tools and advertising proposals.