Grok Build leak: apps built with xAI's agent exposed SpaceXSI data
Grok Build, the vibe-coding agent, put the secret part of its app links where DNS services could log them. Even SpaceXSI's own sales maps ended up findable.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesThe company behind Grok left its own internal documents open to anyone with a link. That is the finding from security firm Claroc, which says a flaw in SpaceXSI's Grok Build vibe-coding agent (a tool that writes and publishes apps from plain-language prompts) exposed data from thousands of users.
Among the exposed material were employee details from a hospital group and a fire department, plus SpaceXSI's own files: an onboarding plan, a sales territory map of 594 strategic accounts, eight X advertising proposals, four live advertiser account boards and two copies of an X brand safety playbook. Only one of the exposed apps asked for a password. Claroc says six other exposed companies are in the Fortune 500 and 26 have more than 1,000 employees. It estimates roughly two percent of the material was serious enough to rate high or critical.
How did the Grok Build leak happen?
The problem was how Grok Build built its links. It used "dice words", randomly generated four-word phrases with up to 38 bits of entropy, which is a measure of how hard something is to guess. But it put that phrase to the left of the domain name. Google's Gemini puts it to the right.
That placement matters. Passive DNS services, which record the domain names devices look up, could capture the links and store them in publicly searchable databases. So people who were never given a link could find and open the page. Claroc calls these pages GhostShares.
What has SpaceXSI done about it?
Claroc told SpaceXSI and the affected companies, and some acted quickly. SpaceXSI reportedly did not respond until Claroc tagged Musk and another company official on X. It then took down 24 of its own exposed apps.
According to Claroc, it has not done the same for apps that other Grok users and organizations left open. If you built something with Grok Build and shared it by link, it is worth checking what that page shows to anyone who finds it.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →
Nāpōwawāʻenakaulua: Webb Finds Earliest Quasar Pair Ever
United Airlines AI agent ban: bots can't tick the check-in box
Jensen Huang resigns as Nvidia CEO; Colette Kress steps in as interim
Windows WinSxS folder: the DISM command that frees up to 10 GB
More in: Security
See all →
ScreenConnect RMM+ plugin flaw lets hackers hit 288 PCs
Is your smart TV spying on you? Questions about TV data
Krakow attacker's iPhone may need Apple's help to unlock
