Grok Build, SpaceX's AI-powered coding agent, is leaking sensitive data from thousands of users due to a flaw in its link-sharing functionality, according to security research from Claroc.
While Grok randomizes URLs for shared apps, the vulnerability allows attackers to enumerate live projects and access their underlying data. Claroc's investigation uncovered internal business plans, advertising proposals, medical exam results, cruise-line operational checklists, and employee names and ID numbers.
SpaceX itself had 24 internal applications built on Grok Build exposing confidential material, including a sales territory map detailing 594 accounts, internal system addresses for sales tools, and an onboarding plan for a new enterprise sales hire.
Claroc notified SpaceX of the vulnerability on Sunday. After receiving no response, Claroc publicly tagged Elon Musk and Grok Manager Matt Palmer on X. SpaceX removed all 24 exposed application links within hours of an email inquiry from Ars, with links returning "app not found" errors by Monday evening.
Beyond SpaceX, Claroc identified affected organizations including Fortune 500 companies and a defense contractor. Asaf Aproz Claroc's co-founder and chief technology officer, is notifying affected companies. After Aprozper briefed the chief information security officer of a luxury cruise line, that company "pulled in their whole security team and are already working to contain the Grok exposure," Aprozper said.
Grok Build's link-sharing feature is designed to streamline app development and deployment, allowing users to quickly create functional applications for internal testing using speech or text input.
