Grok Build, an AI-powered application development platform from SpaceXSI, has been found to leak proprietary business information and sensitive user data due to a critical design flaw in its link-sharing mechanism, as first reported by Ars Technica.
The vulnerability stems from how the platform generates shareable URLs. By placing randomized identifiers to the left of the domain, the links become discoverable through passive DNS monitoring services. This allows unauthorized parties to enumerate and access thousands of live projects. Research from the security firm Claroc revealed that exposed data includes internal business plans, medical records, employee rosters, and confidential sales proposals. Notably, the platform itself leaked internal SpaceXSI documents, including enterprise sales strategies and system addresses.
While a company representative claimed apps are private by default, security researchers found that the platform defaults to public access. The issue highlights a broader industry concern, as similar vulnerabilities have been identified in other AI coding agents. While platforms like Claude and ChatGPT use secure URL structures that prevent DNS exposure, Grok Build and several competitors remain susceptible. SpaceXSI began removing the exposed links following inquiries, but the incident underscores the risks associated with rapid AI deployment without robust security configurations.
Source: Ars Technica
