Grok Build Flaw Leaks Thousands of Users' Sensitive Data, Even SpaceXSI's Own Files

Cybersecurity firm Claroc found that Grok Build, an AI coding tool under SpaceXSI, had a security flaw. It led to sensitive data leaks affecting thousands of users. Even SpaceXSI's own internal files were exposed.

The problem lies in how Grok creates share links. Grok builds links from 4 random words, with up to 38 bits of randomness. But it puts these codes before the domain name instead of in the path. As a result, passive DNS services could collect the links and list them in public databases, so strangers could open the pages without a share link.

Those affected include a hospital group, a fire department, 6 Fortune Global 500 firms, and 26 companies with over 1,000 staff. About 2% of the apps held high or critical risk data. SpaceXSI's leaked files included onboarding plans and sales maps for 594 key customers, and only one app had a password.

Claroc notified the affected companies, and some acted fast. SpaceXSI only responded after being called out on X. It has since taken down 24 of its own apps that exposed internal files, but other affected apps remain open to the public.