Grok Build, the AI coding agent owned by SpaceXSI, leaked proprietary business information and sensitive data from thousands of users through a design flaw in its link-sharing mechanism, security firm Claroc found.
The platform randomizes shareable URLs intended for collaboration, but a specific design choice allows anyone to enumerate live Grok Build projects. Most enumerated links opened applications and revealed all associated data.
Claroc identified exposed information including internal business plans, advertising proposals, medical exam results, and operational checklists from a celebrity cruise line. The leak also included employee names and ID numbers.
SpaceXSI itself was among the affected users. Claroc found 24 internal SpaceXSI applications exposed confidential material, including an onboarding plan for an enterprise sales team member, a sales territory map covering 594 accounts, and internal system addresses for sales tools.
Claroc notified SpaceXSI on Sunday and reported no initial response. After Ars Technica sent questions about the issue, SpaceXSI removed the exposed links within hours. By the time Claroc published its findings publicly, all 24 SpaceXSI application links returned an "app not found" error.
Beyond SpaceXSI's internal exposure, Claroc identified sensitive information from other Grok Build users, including Fortune 500 companies and a defense contractor.
Asaf Aproz Claroc's co-founder and CTO, is notifying affected companies. After speaking with the luxury cruise company's chief information security officer, the firm immediately mobilized its security team to contain the exposure.
The incident underscores a core tension in enterprise AI: rapid deployment versus security maturity. Companies handling confidential business information require stringent security protocols—a foundational competitive moat for platforms in this space. A widespread data leak raises capital allocation questions for enterprises investing in AI development tools, forcing difficult choices between remediation costs and migration to more secure alternatives.
