Research from security firm Claroc confirms that Grok Build, the coding agent from SpaceXSI, is leaking confidential data from thousands of users, including the parent company itself. The platform allows users to generate links to share their applications, but a specific design flaw enables anyone to enumerate these projects and view all associated data without restriction. This vulnerability exposes internal business plans, ad proposals, medical exam results, and employee identification numbers. Notably, SpaceXSI has inadvertently included its own sensitive documents in the leak, such as a confidential onboarding plan for an enterprise sales team and a map detailing 594 sales accounts.
The issue stems from how the application sharing feature functions rather than a breach of user authentication or account security. Clicking a generated link directly opens the app and displays its contents, rendering the randomisation of URLs ineffective. This means the exposure is inherent to the current architecture of the tool. Developers have not indicated any changes to how the system handles data access or project visibility. The risk remains limited to the specific mechanism of app sharing unless the underlying design is altered.
- 24 SpaceXSI apps were found to contain exposed internal documents.
- Anyone with a link can view the full content of a project.
- No evidence suggests user accounts or API behaviour have been compromised.
