- What happened: Thousands of applications built using SpaceXSI’s Grok Build platform were found to be publicly accessible without authentication, leading to significant data leaks.
- Key metric: Of 37,571 analyzed apps, 35,578 were open to anyone, including 24 applications developed by SpaceXSI itself.
- Who is affected: Grok Build users, including SpaceXSI, whose internal business plans, ad proposals, and employee personal data were exposed.
SpaceXSI, the entity formed by the merger of SpaceX and xAI, is facing a significant security incident involving its Grok Build vibe-coding agent. New research from security firm Claroc reveals that thousands of applications developed on the Grok Build platform were publicly accessible without any authentication, resulting in the exposure of a substantial volume of confidential information.
The Scale of the Grok Build Data Leak
According to Claroc’s research, published on November 10, out of 37,571 Grok-built apps analyzed, 35,578 were found to be open online without requiring a sign-in. This design flaw meant that anyone who knew the precise URL of an app could access its data. While Grok initially randomized URLs to restrict access, a design decision by the platform’s developers inadvertently made it possible to enumerate these projects, bypassing intended security measures.
Among these exposed applications were 24 apps built by staff at SpaceXSI itself. The data revealed from these SpaceXSI apps included:
- A confidential onboarding plan for a new member of SpaceXSI’s enterprise sales team.
- A sales territory map detailing 594 accounts.
- Internal system addresses for sales team tools.
- Advertising proposals.
These findings underscore the vulnerability even within the systems of the company providing the platform.
Types of Data Exposed
The leak extended beyond SpaceXSI’s internal data, affecting information from thousands of other users. Claroc’s research indicated that the exposed data encompassed:
- Internal business plans.
- Ad proposals.
- Medical exam results.
- Galley checklists from a celebrity cruise line.
- Employee names and ID numbers.
While the majority of the open apps were games, landing pages, and calculators, approximately 1 in 10 contained internal business or other sensitive information. This incident follows other security concerns in the AI space, such as United Airlines banning AI agents from booking flights due to security and regulatory risks.
| Metric | Value |
|---|---|
| Total Apps Analyzed | 37,571 |
| Publicly Accessible Apps | 35,578 |
| Percentage Publicly Accessible | ~94.7% |
| Apps Built by SpaceXSI | 24 |
| Apps Containing Confidential Data | ~10% of publicly accessible |
This incident highlights the critical importance of rigorous security auditing for development platforms, especially those handling sensitive data. For developers and companies utilizing tools like Grok Build, it serves as a stark reminder to double-check privacy settings and access permissions. Even if a platform touts security measures, the ultimate responsibility for data protection often rests with the application developer. The incident also raises questions about transparency and security standards within the rapidly evolving landscape of AI tools and agents, such as Grok.
While the article points to clear security flaws in Grok Build, it’s worth considering the broader implications. How many users truly understood the default public access settings, and what responsibility does the platform bear for making these defaults so insecure? It feels like a significant oversight to allow such widespread exposure, even with randomized URLs, if enumeration was so easily bypassed. This raises concerns about the ‘vibe-coding’ approach if fundamental security isn’t thoroughly baked in.