Grok Build Link Flaw Exposed SpaceXSI Data, Security Firm Says

Grok Build, SpaceXSI’s vibe-coding agent, created links to apps that were publicly discoverable by DNS services, according to security firm Claroc. Engadget reported on Wednesday that Claroc told Ars Technica the link-handling flaw let certain domain-name systems reveal the pages without authentication.

Employee information was exposed at SpaceXSI itself, a hospital group, and a fire department. Claroc researchers wrote that they were surprised the company behind Grok had left its own internal material open to anyone holding the link. They named such pages GhostShares because no one needed to receive the link to find them.

Within SpaceXSI, open files included an onboarding plan, a sales territory map of 594 strategic accounts, eight advertising proposals, four live advertiser account boards, and two copies of a brand safety playbook. One of the exposed apps required a password. Six other affected companies were Fortune 500 members, and 26 had more than 1,000 employees. Claroc estimated that roughly 2 percent held material serious enough to be rated high or critical.

The link design was the root cause. Grok Build generated links from four random terms whose combined entropy could reach 38 bits, but placed that segment before the domain. Google’s Gemini places the random string after the domain. Because of that, passive DNS monitoring could capture the links and file them in public search databases.

Claroc said it shared findings with SpaceXSI and affected organizations. Some moved quickly to contain the Grok exposure. SpaceXSI did not respond until Claroc tagged Elon Musk and another company official on X, according to Engadget. SpaceXSI then took down 24 of its own exposed apps, but Claroc wrote that the company has not done the same for apps left open by other Grok users.