What happened
Grok Build, the vibe-coding agent from SpaceXSI (the merged SpaceX and xAI), is leaking sensitive data through the links that let users share their apps. Research by security firm Claroc found that a design decision undermines the platform's effort to randomize URLs, making it possible for anyone to enumerate thousands of live Grok Build projects.
What leaked
Clicking those links opens the app and, except in rare cases, reveals all data associated with it. The exposed material includes internal business plans, ad proposals, medical exam results, checklists from a celebrity cruise line, and employee names and ID numbers.
The ironic part
Some of the sensitive data comes from apps built by SpaceXSI itself. Claroc found 24 such apps; examples include a confidential onboarding plan for a new member of the enterprise sales team, a sales territory map covering 594 accounts, internal system addresses for sales tools, and advertising proposals.
Why it matters
Vibe-coding tools make it easy to build and share apps quickly, but the security of share links depends on the platform's default behavior. The incident shows how critical access control is in AI-assisted app platforms.
