GoKawiilSecurity firm finds Grok Build coding agent exposes thousands of users' private data
Researchers at Claroc say Grok Build, the vibe-coding tool from SpaceXSI, generates shareable app links whose supposedly randomized URLs can actually be enumerated, exposing data from thousands of live projects. The leaked material reportedly includes internal business plans, medical results, employee IDs, and even confidential documents from roughly two dozen apps built internally by SpaceXSI itself, such as sales onboarding plans and account territory maps.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident suggests that AI coding tools can make it easy to spin up functional apps while skipping basic security practices like authentication, potentially exposing sensitive data at scale. Claroc's account indicates SpaceXSI did not respond to private notification before the researcher publicized the issue on X, which could imply gaps in the company's vulnerability-response process, though that reasoning is not confirmed by SpaceXSI.
- Grok Build's shareable links can reportedly be enumerated, bypassing their randomization protections.
- Claroc says leaked data includes business plans, medical records, and employee information from thousands of apps.
- About two dozen apps built internally by SpaceXSI were reportedly among those exposing confidential data.
Source: arstechnica.com, 2026-11-10
Published there as: “Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.