.png){kind=logo}
A security flaw in SpaceXSI's Grok Build coding agent has exposed confidential company information and user data, raising fresh concerns about the safety of AI-powered development tools.
The issue was discovered by cybersecurity firm Claroc, which found that thousands of applications created using Grok Build could be accessed by people who were never permitted to view them. The exposed information included internal business documents, employee details, and sensitive material belonging to SpaceXSI itself.
According to the researchers, the problem was linked to the way Grok Build generated shareable links. These links appeared difficult to guess, but their structure made them visible through public DNS tracking services. This allowed outsiders to discover applications without receiving a direct invitation.
Claroc found 24 applications built by SpaceXSI employees that could be opened through these links. The exposed material included an onboarding plan, a sales territory map covering 594 strategic accounts, eight advertising proposals for X and four live advertiser account boards.
Also Read: Tech Mahindra and SpaceXSI Join Hands to Modernize Enterprise Software
Researchers also found two copies of an internal X brand safety playbook. Some of the documents contained information that would normally remain restricted to employees and business teams.
The problem was not limited to SpaceXSI. Claroc said applications belonging to a hospital group, a fire department and several large companies were also affected. Six of the affected organisations were Fortune 500 companies, while 26 employed more than 1,000 people.
Claroc said Grok Build placed randomly generated four-word identifiers before the main domain name. This made the links visible to passive DNS services, which record domain lookups and can make them searchable.
Also Read: SpaceXSI Subscription: Musk Unifies Grok, X, Cursor in a Single Bundle
The security firm shared its findings with SpaceXSI and other affected organisations. SpaceXSI eventually removed its 24 internal applications after Claroc tagged Elon Musk and another company official on X. However, Claroc said the company had not taken similar action for applications created by other users and organisations.
The incident highlights a security risk with AI coding assistants that can build and publish applications with little technical input. While these tools make software development easier, poorly configured sharing settings can expose information that users never intended to make public.