Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI

Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI

The information is revealed through links allowing Grok Build users to share their apps with others. Grok takes steps to randomize the URLs so only people who know the exact URL can access the data stored there. A design decision by developers of the platform, however, completely torpedoes that objective and makes it possible for anyone to enumerate thousands of live Grok Build projects. Except in rare cases, clicking those links opens the app and reveals all data associated with it.

You had one job

“We were shocked,” Claroc said in a Tuesday post. “The company that makes Grok had its own internal material open to anyone holding the link, and we had never been given it. Had the sales team bought a tool for this, it would have sat behind company sign-in, open only to the team. Built with AI, it went live open to anyone with the link.

Ars Video

[What Happens to the Developers When AI Can Code? | Ars Frontiers](https://www.arstechnica.com/video/watch/what-happens-to-the-developers-when-ai-can-code-ars-frontiers)

Claroc found sensitive data belonging to other Grok Build users, some working for Fortune 500 companies and a defense contractor. Some of the affected organizations and data revealed includes:

A Peruvian construction company: occupational-health dashboard with 3,784 worker medical exams

Tesla: service-center scorecard naming 22 technicians with productivity and bonus status

A US-Navy ship engineering contractor: roster of 108 people on a Navy logistics support contract

A leading luxury cruise company: a galley checklist for a celebrity cruise line listing crew by full name and employee ID

A healthcare company: hospital staff app with a roster of about 3,565 employees by name and ID

A US IT services company: a confidential proposal to a large retail customer with the hardware bill of materials

A Norwegian-Finnish aerospace and defense group: load board and loading procedure for an explosives building at a US plant, plus its HSE training matrix

A US home construction company: sales callsheet with about 583 home-buyer prospects, budgets and financing notes

A Malaysian holding company: project monitor for 37 developments with profit and sales figures

A US data center colocation and hosting service: confidential IP transit proposal to a European carrier

Asaf Aprozper, the co-founder and CTO of Claroc, said he’s in the process of notifying companies. After speaking to the CISO of the luxury cruise company, it “pulled in their whole security team as soon as we shared the findings and are already working to contain the Grok exposure.”

A fatal flaw… shared by most other AI platforms

Link sharing for Grok Build is intended to streamline the process of developing and deploying apps. A user can input speech or text and have a working app ready for internal testing within minutes. The links are designed to give developers a way to get the app in front of authorized users quickly. The very left of the URLs contain two or more “dice words,” meaning randomly generated phrases such as “failing chassis traders,” although users can modify them. The rightmost portion of the link is grok.me. The URL for an X ads campaign plan was: https://cinder-crane-sand-frost.grok.me.

The scheme is intended to prevent links from being easily guessable. When done correctly, a phrase comprising three dice words has roughly 38 bits of entropy, amounting to billions of possible combinations. The idea—sometimes called capability-based access control—is that possession of the URL serves as authorization to the resources behind it. Google has long used this technique to make URLs easy to share but hard to guess. A URL share on that platform might look like: https://docs.google.com/document/d/1BxiMVs0XRA5nFMdKvBdBZjgmUUqptlbs74OgvE2upms/edit

A representative with Cursor, the AI coding service SpaceXSI recently acquired, said in an email that Grok Build “apps are private by default and nothing goes public unless the creator chooses to share it.” The representative said that competing coding agents from ChatGPT, Lovable, and Bolt also give users the ability to generate shareable links.

Aprozper’s tests contradict the representative’s statement. In all cases, Grok Build required users to change anyone with the link to one of the other two options.

The Cursor statement regarding other AI coding platforms is correct. Aprozper said that app builders, including Lovable, Bolt, and Replit, “also give each app its own web address, so the same DNS records expose them, too. However, Grok is where we found by far the most sensitive company data.” That means that people using these other platforms are also at risk of exposing sensitive data through shared links. Interestingly, AI platforms that follow the correct sharing link practice include Claude’s published artifacts (claude.ai/public/artifacts/), ChatGPT’s shared conversations (chatgpt.com/share/), and Gemini (gemini.google.com/share/). For all three, the secret randomness is in the path, so DNS never sees it.

The representative didn’t respond to follow-up questions, including if SpaceXSI intentionally exposed the proprietary internal information, why the company removed the data after Ars asked about it, and if it planned to notify customers who also exposed similar types of information. Anyone using shareable links with Grok Build should choose the “invite others” option unless they intend to make an app widely available.

Dan GoodinSenior Security Editor

Dan GoodinSenior Security Editor

I think you'd need a unique (but non-secret) element in the domain name to keep each application on a separate origin, as a security boundary, and also put a secret element in the URL's path which won't be leaked over DNS.

Nov 10, 2026 at 11:08 PM

Am I understanding the article correctly, that after SpaceXSI were notified they locked their own shit down, but left the other companies’ data flapping in the wind?

Maybe they don’t have a way to lock down others’ stuff (I don’t know the technical aspects), but shouldn’t they have at least notified the other users of the security flaw?

Nov 11, 2026 at 11:23 AM

1. 1.Anduril says its first satellite can see adversaries maneuver in orbital night

2. 2.Trump wanted little Kei trucks for America, Toyota makes it happen

3. 3.Apple is shuttering its 28-year-old online community forum

4. 4.Big Walk used AI to fix a bug. Now the indie gaming world is having a reckoning.

5. 5.CEO Jensen Huang's job is suddenly on the line at Nvidia

Ars Technica has been separating the signal from the noise for over 25 years. With our unique combination of technical savvy and wide-ranging interest in the technological arts and sciences, Ars is the trusted source in a sea of information. After all, you don’t need to know everything, only what’s important.