Grok Build app links exposed private data, including SpaceXSI internal material
Claroc says only SpaceXSI's own apps were taken down so far, while other users' exposed projects remain reachable.
Security firm Claroc found that Grok Build, the vibe-coding agent from SpaceXSI, exposed private data from thousands of its users, including SpaceXSI's own internal material. The app links were built with a randomised phrase placed on the left of the domain, which let passive DNS services index them and made live projects discoverable by anyone. Exposed documents included a confidential onboarding plan, a sales territory map covering 594 accounts, and eight X advertising proposals, and Claroc estimated about two percent of the affected projects held serious or critical material. SpaceXSI reportedly only responded after Claroc contacted Musk and another executive on X, and then removed 24 of its own apps, but had not yet done the same for the other exposed apps.
Why it matters
Users of AI coding tools that publish live app links may have sensitive projects exposed to anyone who finds them through public DNS records. The problem came from how the links were built, which left them open to indexing by passive DNS services. Developers who rely on such tools now face the question of whether their deployed projects can be found by others, and the affected users have not yet had their exposed apps removed. Claroc's estimate that about two percent of affected projects held high or critical material suggests the risk is concentrated rather than universal, but the scale across thousands of users is still significant.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.