Grok Build

Security firm Claroc found that over 35,000 apps built with Grok are accessible without authentication, with roughly 650 to 800 containing private data, including internal sales tools and employee performance records from SpaceXSI, X and Tesla, plus ICU patient records and plaintext credentials. The root cause is that Grok assigns each app a hard-to-guess random subdomain but relies on obscurity rather than real access control. Apps created by SpaceXSI and X employees have been taken offline, while many third-party apps remain exposed.

Security firm Claroc found that share links generated by SpaceXSI's AI coding tool Grok Build are publicly indexable via passive DNS services, exposing sensitive data from thousands of users and SpaceXSI itself, with roughly 2% of apps containing high-severity information. The flaw stems from Grok placing random identifiers in the subdomain rather than the URL path; SpaceXSI removed 24 of its own exposed apps only after being publicly called out, but took no equivalent action for other affected users.

Research from security firm Claroc shows that Grok Build, the vibe-coding agent from SpaceXSI, exposes data from thousands of live projects because its share-link design allows anyone to enumerate URLs. Leaked material includes business plans, medical exam results, and employee IDs, with roughly two dozen of the affected apps built by SpaceXSI itself.