A security investigation by Claroc has identified a significant data exposure vulnerability affecting Grok Build, the coding agent platform operated by SpaceXSI. The research identified approximately 35,000 live Grok Build projects, with roughly 95 percent of them publicly accessible to anyone with knowledge of the link. The vulnerability stems from how the platform implements its link-sharing mechanism.
Grok Build allows developers to share applications through randomized URLs intended to be difficult to guess. The platform uses “dice words”—randomly generated phrases positioned to the left of the domain—as the randomization method. However, this positioning allows the links to be easily enumerated using passive DNS services, which monitor and record DNS lookups. Had the randomization been placed to the right of the domain, as competing platforms like Google use, the links would have remained invisible to passive DNS searches.
The exposed data includes proprietary business documents, medical records, employee information, and internal communications from various organizations. Notably, SpaceXSI itself had 24 applications leaking sensitive internal materials, including confidential onboarding documents, sales territory maps, internal system addresses, and advertising proposals. Other affected entities include employees of Fortune 500 companies and a defense contractor. Claroc notified SpaceXSI of the issue on Sunday, and after public escalation on social media, SpaceXSI removed access to its own exposed applications within hours.
The vulnerability reflects a broader security concern affecting multiple AI coding platforms. Lovable, Bolt, and Replit employ similar link-sharing architectures and face comparable risks of data exposure through passive DNS enumeration. However, Grok Build showed the highest volume of exposed sensitive company information during the research. Additionally, Meta’s Muse coding agent recently suspended its link-sharing feature after encountering similar security issues.
A Cursor representative stated that Grok Build apps are private by default, though research findings indicate users must manually adjust sharing settings from the default “Anyone with the link” configuration. The incident underscores the security implications of architectural decisions in cloud-based development platforms and the importance of proper implementation of capability-based access control mechanisms.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI