Ars Technica reports that the Grok Build coding agent leaked confidential information belonging to various firms, including SpaceXSI, due to a flaw in how its share links are structured. Claroc discovered that sensitive dashboards, proposals, and internal records from multiple organizations were accidentally exposed through the platform.
Key takeaways
- Claroc found sensitive data belonging to multiple organizations using Grok Build.
- The exposed information includes records from Tesla, a defense contractor, and a luxury cruise company.
- Asaf Aprozper of Claroc is actively notifying affected businesses about the leaks.
- A flawed URL structure allowed the links to be easily enumerated using passive DNS services.
What is the Grok Build coding agent data leak?
Grok Build lets users type or speak requests to create functional apps within minutes for internal testing. To share these apps, the platform generates links that use random dice words to block easy guessing. However, SpaceXSI placed these random phrases to the left of the domain instead of the right. This mistake allowed passive DNS services to track and capture every new URL lookup in a public database.
Asaf Aprozper, co-founder and CTO of Claroc, stated that he is currently contacting the affected companies. When his team spoke with the CISO of the luxury cruise company, that firm immediately pulled in its security team to contain the exposure, according to Ars Technica.
What confidential info was exposed by spacexsi and other firms?
The leaked files covered a wide range of sensitive corporate operations. Affected records included an occupational-health dashboard for a Peruvian construction company with 3,784 worker medical exams and a Tesla service-center scorecard listing 22 technicians with their productivity and bonus status.
Other exposed files featured a US-Navy ship engineering contractor roster, a luxury cruise galley checklist, a hospital staff app with about 3,565 employee IDs, and an IT services confidential proposal. Additional leaks involved a Norwegian-Finnish defense group explosives building load board, a US home builder sales callsheet with 583 prospect records, a Malaysian holding company project monitor, an auto transport quote desk with 4,000 orders, and a US data center colocation proposal.
Why it matters
This incident exposes the hidden risks of deploying internal testing links without proper URL token placement. Organizations trusting AI tools with sensitive workforce rosters, customer proposals, and proprietary operational data face direct exposure when platforms misconfigure basic security mechanisms. Meta recently suspended a similar link-sharing feature on its Muse agent after it leaked sensitive data, pointing to a wider industry challenge in securing generated web apps.
Frequently asked questions
The leak happened because SpaceXSI placed the random dice words to the left of the domain in its share links instead of the right, allowing passive DNS services to easily capture and enumerate them.
Claroc discovered the data exposure, and its co-founder and CTO Asaf Aprozper began notifying the affected companies about the confidential files found on the platform.
Affected organizations included Tesla, a Peruvian construction company, a luxury cruise company, a healthcare company, a US-Navy ship engineering contractor, and a Norwegian-Finnish defense group.
Grok Build links are designed to use random dice words to create capability-based access control, ensuring that only people who possess the specific URL can access the app behind it.
Meta suspended a link-sharing feature on its Muse agent after it was also found to be leaking sensitive data.
Based on reporting by Ars Technica. Read the original article
