Grok Build, xAI's AI coding agent, is leaking sensitive business information from thousands of users through a design flaw in its link-sharing functionality. Security researchers at Claroc identified the vulnerability Tuesday, finding that the platform's randomized shareable URLs are easily enumerable, allowing anyone to access live projects and their associated data.
Claroc discovered 24 applications built by SpaceX itself exposing confidential material: an onboarding plan for a new enterprise sales team member, a sales territory map detailing 594 accounts, and internal system addresses for sales tools. Other exposed data included internal business plans, advertising proposals, medical exam results, and employee identification numbers.
The vulnerability stems from how Grok Build generates shareable links. While the platform attempts to randomize URLs, the enumeration method allows straightforward discovery of active projects. Clicking these links directly opens the application and reveals all associated data without authentication.
Claroc notified SpaceX on Sunday. After receiving no response, the firm alerted Elon Musk and Grok manager Matt Palmer via X. SpaceX removed the exposed links within hours of receiving questions from Claroc. All 24 internal links returned an "app not found" error by the time Claroc published its findings.
Beyond SpaceX, Claroc identified sensitive data belonging to other Grok Build users, including employees of Fortune 500 companies and a defense contractor. Asaf Aproz Claroc's co-founder and CTO, said he is notifying affected companies. A luxury cruise company's chief information security officer immediately began containment efforts after learning of the exposure.
Grok Build is designed to streamline enterprise application development, allowing users to generate working applications for internal testing by inputting speech or text. The platform's rapid deployment model—a key selling point for time-sensitive enterprise development—appears to have bypassed the access controls needed to protect sensitive data.
