Security researchers at Claroc identified a significant data exposure vulnerability affecting Grok Build, the coding agent platform offered by SpaceXSI. The flaw stems from how the platform implements URL-based sharing for applications, which was intended to allow developers to quickly distribute apps for testing and deployment.
The vulnerability exploits a critical design decision in how Grok Build constructs shareable links. While the platform uses randomized phrases to make URLs difficult to guess, the random elements are positioned at the beginning of the domain name rather than at the end. This placement allows the links to be enumerated through passive DNS services, which monitor and record domain name lookups. Claroc’s analysis identified approximately 43,601 links ending in grok.me, with nearly 95 percent of them being publicly accessible.
The exposed data included various categories of sensitive information from users across multiple organizations. Researchers documented internal business plans, medical records, personnel details, cruise ship operational documents, and advertising proposals. Notably, approximately two dozen apps created by SpaceXSI itself contained confidential materials, including sales team onboarding documents, account territory maps, internal system addresses, and marketing proposals. Users working for Fortune 500 companies and defense contractors also had sensitive data exposed through the platform.
SpaceXSI removed the exposed links from its own apps within hours after being contacted, returning error messages when accessed. The company did not respond to initial notification attempts by the researchers, prompting a public disclosure on social media. Other companies affected by the exposure are being notified of the breach, with at least one major luxury company already mobilizing its security team to address the exposure.
The issue extends beyond Grok Build, as researchers noted that competing platforms including ChatGPT’s coding agent, Lovable, Bolt, and Replit employ similar link-sharing mechanisms and therefore face comparable risks. However, Claroc found that Grok Build contained substantially more exposed sensitive company data than the competing platforms reviewed.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI