Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Researcher finds 35,000 Grok Build apps wide open to anyone who looked for them.
TL;DR
- Grok Build, an AI coding agent, is leaking sensitive data from thousands of users due to a flaw in its app-sharing functionality.
- The exposed data includes proprietary business information, medical exam results, employee details, and internal company documents.
- Research firm Claroc found over 35,000 Grok Build apps were publicly accessible, with many containing confidential data.
- Even SpaceXSI, the company behind Grok Build, had its own internal apps and sensitive data exposed.
- The flaw lies in the placement of random URL elements, making them easily discoverable through passive DNS services.
- Users are advised to change the default sharing setting from 'Anyone with the link' to 'Invite others' to protect their data.