Security flaw in grok build exposes sensitive data for SpaceXSI and major corporations

Security firm Claroc discovered a vulnerability in the AI coding tool Grok Build, developed by SpaceXSI, which allowed sensitive user and internal data to be exposed. This flaw, termed GhostShares, permits external parties to access private pages simply by searching for the generated links via certain DNS services, even without possessing the direct share link. The breach exposed internal SpaceXSI documents, including sales territory maps for 594 key clients, X platform ad proposals, and brand safety manuals. The affected data included information pertaining to a hospital group and a fire department. Claroc noted that only one application had password protection among the exposed materials. The vulnerability stems from how Grok Build embeds its unique identifiers—which have a randomness of up to 38 bits—at the domain name level rather than in the URL path, unlike Google Gemini. Claroc informed SpaceXSI and affected entities, estimating that about 2% of the applications contained high or severe risk sensitive information. Following the disclosure, SpaceXSI removed 24 of its own applications containing exposed data, though no similar action was taken for other publicly accessible Grok applications.