SpaceXSI

Security firm Claroc found that over 35,000 apps built with Grok are accessible without authentication, with roughly 650 to 800 containing private data, including internal sales tools and employee performance records from SpaceXSI, X and Tesla, plus ICU patient records and plaintext credentials. The root cause is that Grok assigns each app a hard-to-guess random subdomain but relies on obscurity rather than real access control. Apps created by SpaceXSI and X employees have been taken offline, while many third-party apps remain exposed.

Security firm Claroc found that share links generated by SpaceXSI's AI coding tool Grok Build are publicly indexable via passive DNS services, exposing sensitive data from thousands of users and SpaceXSI itself, with roughly 2% of apps containing high-severity information. The flaw stems from Grok placing random identifiers in the subdomain rather than the URL path; SpaceXSI removed 24 of its own exposed apps only after being publicly called out, but took no equivalent action for other affected users.

Security firm Claroc found that nearly 95 percent of more than 37,000 web apps built with Grok were publicly accessible without login, exposing confidential SpaceXSI and X business documents, patient lab values, shift schedules, and plaintext passwords. The root causes are insecure default publishing settings, easily discoverable URLs, and flawed access controls in Grok-generated code, underscoring systemic default-security risks in AI-generated applications.

Research from security firm Claroc shows that Grok Build, the vibe-coding agent from SpaceXSI, exposes data from thousands of live projects because its share-link design allows anyone to enumerate URLs. Leaked material includes business plans, medical exam results, and employee IDs, with roughly two dozen of the affected apps built by SpaceXSI itself.