Grok Build leaks data from 35,000 apps, including SpaceXSI's own
Security firm Claroc found Grok Build's share links could be enumerated, exposing business plans, medical results and confidential SpaceXSI sales files.
Summary
Grok Build, SpaceXSI's agent for building apps from plain-language prompts, left 35,000 user apps open to anyone who looked for them, according to research by security firm Claroc described in Ars Technica's report on Tuesday.
The flaw turns a sharing feature into a public index: anyone could list live Grok Build projects and, except in rare cases, open each app along with all of the data stored in it. Among the exposed projects were 24 built by SpaceXSI itself, the merged SpaceX and xAI, which offers the platform.
Grok Build lets users share their apps with others through links, and the platform randomizes those URLs so that only people who know the exact address can reach the data behind them. A design decision by the platform's developers undid that protection and made it possible to enumerate thousands of live projects, Claroc found.
The exposed material included internal business plans, advertising proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers. In SpaceXSI's own apps, Claroc found an onboarding plan marked confidential for a new member of the enterprise sales team, a sales territory map covering 594 accounts, internal system addresses for sales tools, and advertising proposals.
Elon Musk founded xAI in 2023 and launched its Grok chatbot that November; the company later merged with SpaceX to form SpaceXSI and has extended the Grok line into agent products. Musk wrote on X that operating costs for Grok Bot, the company's general-purpose agent, were “unsustainably high relative to revenue.”