Grok Build, the vibe-coding agent from SpaceXSI, is leaking data—some of it proprietary business information and other sensitive secrets—from thousands of its users, including the very same Elon Musk-owned company that offers the platform, new research shows.

The information is revealed through links allowing Grok Build users to share their apps with others. Grok takes steps to randomize the URLs so only people who know the exact URL can access the data stored there. A design decision by developers of the platform, however, completely torpedoes that objective and makes it possible for anyone to enumerate thousands of live Grok Build projects. Except in rare cases, clicking those links opens the app and reveals all data associated with it.

You had one job

Research from security firm Claroc shows that the exposed data includes things like internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers. Ironically, some of the sensitive data comes from two-dozen apps built by SpaceXSI (the name of the now-merged SpaceX and xAI) itself. A small sampling of the documents revealed in the SpaceXSI apps—Claroc found 24 of them—include an onboarding plan, marked confidential, for a new member of SpaceXSI’s enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals.

“We were shocked,” Claroc said in a Tuesday post. “The company that makes Grok had its own internal material open to anyone holding the link, and we had never been given it. Had the sales team bought a tool for this, it would have sat behind company sign-in, open only to the team. Built with AI, it went live open to anyone with the link.

Claroc notified SpaceXSI of the privacy spill on Sunday. When no one responded, a Claroc official took to X to tag both Musk and Grok Manager Matt Palmer about the threat. At the time this post went live almost all data remained available with one notable exception: the contents from the 24 SpaceXSI apps. All of them were exposing the information on Monday evening. SpaceXSI began removing the links within a few hours of Ars sending an email with questions for this article. At the time this post went live, links for all 24 apps returned an “app not found” error.

Claroc found sensitive data belonging to other Grok Build users, some working for Fortune 500 companies and a defense contractor. Some of the affected organizations and data revealed includes:

• A Peruvian construction company: occupational-health dashboard with 3,784 worker medical exams
• Tesla: service-center scorecard naming 22 technicians with productivity and bonus status
• A US-Navy ship engineering contractor: roster of 108 people on a Navy logistics support contract
• A leading luxury cruise company: a galley checklist for a celebrity cruise line listing crew by full name and employee ID
• A healthcare company: hospital staff app with a roster of about 3,565 employees by name and ID
• A US IT services company: a confidential proposal to a large retail customer with the hardware bill of materials
• A Norwegian-Finnish aerospace and defense group: load board and loading procedure for an explosives building at a US plant, plus its HSE training matrix
• A US home construction company: sales callsheet with about 583 home-buyer prospects, budgets and financing notes
• A Malaysian holding company: project monitor for 37 developments with profit and sales figures
• An auto transport company: quote desk with about 4,000 vehicle-transport orders, prices, and margins
• A US data center colocation and hosting service: confidential IP transit proposal to a European carrier

Asaf Aprozper, the co-founder and CTO of Claroc, said he’s in the process of notifying companies. After speaking to the CISO of the luxury cruise company, it “pulled in their whole security team as soon as we shared the findings and are already working to contain the Grok exposure.”

A fatal flaw… shared by most other AI platforms

Link sharing for Grok Build is intended to streamline the process of developing and deploying apps. A user can input speech or text and have a working app ready for internal testing within minutes. The links are designed to give developers a way to get the app in front of authorized users quickly. The very left of the URLs contain two or more “dice words,” meaning randomly generated phrases such as “failing chassis traders,” although users can modify them. The rightmost portion of the link is grok.me. The URL for an X ads campaign plan was: https://cinder-crane-sand-frost.grok.me.

The scheme is intended to prevent links from being easily guessable. When done correctly, a phrase comprising three dice words has roughly 38 bits of entropy, amounting to billions of possible combinations. The idea—sometimes called capability-based access control—is that possession of the URL serves as authorization to the resources behind it. Google has long used this technique to make URLs easy to share but hard to guess. A URL share on that platform might look like: https://docs.google.com/document/d/1BxiMVs0XRA5nFMdKvBdBZjgmUUqptlbs74OgvE2upms/edit

There’s a fatal flaw in the way SpaceXSI has implemented the mechanism. Instead of being to the right of the domain—as is the case with Google links—the randomness for Grok Build links is positioned to the left of it. That allows the links to be easily enumerated using passive DNS services. These services monitor central DNS lookup servers. When a server lookup requests the IP address of a previously never-before-seen URL, the transaction is captured in a publicly searchable database. Had Grok followed Google’s approach, the links would have been invisible to passive DNS searchers. Muse, the Meta agent that CEO Mark Zuckerberg said was built from the ground up for security, recently suspended a link-sharing feature after it too was found leaking sensitive data.