Security flaw in grok build agent exposes sensitive data from users, including SpaceXSI projects

New security research indicates that Grok Build, the coding agent developed by SpaceXSI, is leaking confidential and sensitive information belonging to thousands of its users. This data exposure occurs through the platform's application sharing links, which, despite randomization efforts by the developers, allow unauthorized enumeration of live projects. Claroc, a security firm, discovered that the compromised data includes highly sensitive materials such as internal business plans, medical exam results, employee ID numbers, and advertising proposals. Notably, the breach affected applications built by SpaceXSI itself (the entity resulting from the merger of SpaceX and xAI). Among the 24 documents sampled from SpaceXSI apps, the exposed information included a confidential onboarding plan for a new enterprise sales team member, a sales territory map covering 594 accounts, and internal system addresses for sales tools.