Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI

SpaceXSI’s own AI‑coding platform, Grok Build, has just turned into a data‑leak faucet, and the fallout is a cautionary tale for anyone who thinks “shareable link” equals “secure.” Security firm Claroc uncovered that the randomised URLs Grok uses to let developers showcase apps are not just guessable – they’re enumerable, exposing internal business plans, sales maps, medical results and more from thousands of users, including the very company that built the service.

How the leak happened

Grok Build’s promise was simple: type a prompt, get a working app, and share a link so teammates can test it. The link format puts the random “dice words” – phrases like “failing chassis traders” – to the left of the domain, e.g., https://cinder-crane-sand-frost.grok.me. The idea mirrors Google’s capability‑based URLs, where possession of the link grants access.

But unlike Google, which hides the random string in the path (right side of the domain), Grok’s placement on the left side makes the URLs visible to passive DNS services. Every time a new link is resolved, the lookup is logged in publicly searchable DNS databases. Claroc’s passive DNS search returned 43,601 distinct Grok links, and more than 35,000 of those – roughly 95 % – opened the app to anyone who clicked.

What was exposed

The exposed data spans a startling range: internal business plans, ad proposals, medical exam results, galley checklists from a luxury cruise line, and employee names with ID numbers. Even more damning, two‑dozen apps built by SpaceXSI itself leaked proprietary material. Claroc sampled 24 documents from those apps, uncovering a confidential onboarding plan for a new enterprise sales hire, a sales territory map covering 594 accounts, internal system addresses for sales tools, and advertising proposals.

Claroc’s co‑founder and CTO, Asaf Aprozper, said the firm is notifying affected companies, noting that a luxury cruise client “pulled in their whole security team” once the findings were shared. The breach also touches Fortune 500 firms and a defense contractor, underscoring that the problem isn’t limited to small‑scale developers.

Why the design is fundamentally broken

The core flaw is the location of the random token. By putting the entropy to the left of the domain, Grok makes each link a DNS record that can be harvested en masse. Passive DNS collectors, which monitor lookups across the internet, can enumerate every possible combination of dice words and compile a list of live apps. When the randomness sits in the path, as with Google Docs or Claude’s public artifacts, DNS never sees it, keeping the token out of the public eye.

Grok’s default setting compounds the issue: by default the link is set to “Anyone with the link.” Users must manually switch to “invited users” or “only you.” Claroc’s tests showed that the platform never defaults to a private mode, contradicting a SpaceXSI spokesperson’s claim that “apps are private by default.” The mismatch between marketing language and actual behaviour is a classic example of “security by obscurity” that collapses under real‑world scrutiny.

How other AI coding platforms compare

SpaceXSI isn’t the only service offering shareable links, but it appears to be the worst offender. Claroc noted that platforms like Lovable, Bolt, Replit, and even SpaceXSI’s own Cursor also generate unique URLs that sit in the DNS record, exposing them to enumeration. However, the data they uncovered from Grok was by far the most sensitive, suggesting that Grok’s user base – including high‑value corporate accounts – is either larger or more lax about link permissions.

There are AI services that get the sharing model right. Claude’s public artifacts, ChatGPT’s shared conversations, and Gemini’s share links all keep the random token in the path, meaning passive DNS never sees the secret. Those designs demonstrate that secure sharing is achievable without sacrificing the convenience of a quick link.

The business‑risk angle for independent hosting providers

For independent hosting providers and SaaS founders, Grok’s breach is a textbook case of how a seemingly minor UX decision can explode into a massive compliance nightmare. If you’re offering a “shareable link” feature, you must ask: where does the secret live? If it lives in the DNS record, you’re handing attackers a free list of live endpoints. The cost of a breach – legal penalties, loss of customer trust, and the operational scramble to remediate – can dwarf any perceived convenience gain.

Moreover, the incident highlights the danger of relying on “capability‑based” security without a proper threat model. Capability tokens must be unguessable *and* hidden from passive observers. Failing that, you’re essentially handing out master keys to anyone with a DNS scraper.

What SpaceXSI did – and didn’t – do

Claroc notified SpaceXSI on a Sunday, and after no response, took the issue public on X, tagging Elon Musk and Grok manager Matt Palmer. SpaceXSI began pulling the offending links within hours of Ars sending an email, and by the time this article went live the 24 internal apps were returning “app not found.” However, the broader set of 35,000+ public links remained accessible, and there is no indication that SpaceXSI has patched the underlying DNS‑exposure flaw.

The reactive approach – removing links after they’re exposed – is a Band‑Aid at best. A proactive fix would involve moving the random token to the URL path, changing the default sharing setting to private, and possibly adding server‑side authentication checks for any link that grants access to data stores. Until those changes are made, the platform remains a liability for any enterprise that trusts it with confidential assets.

Actionable steps for founders and dev teams

First, audit any shareable‑link feature you expose. Verify that the secret component lives in the path, not the subdomain, and confirm that default permissions are set to private. Second, implement server‑side access controls that require authentication beyond mere possession of a URL – a token check or signed JWT can add a layer of defense.

Third, monitor passive DNS feeds for your domain. If you see a surge of new subdomains, that’s a red flag that your link scheme is being enumerated. Fourth, educate users on the risks of “anyone with the link” settings; many developers assume the random URL is enough, but as Grok shows, it isn’t.

Finally, treat any data leakage as a breach event. Have an incident response plan ready: notify affected customers, rotate secrets, and publicly disclose the issue with a clear remediation timeline. Transparency can salvage trust, but only if you act swiftly and honestly.

Grok Build’s leak is a wake‑up call that the AI‑coding hype can’t mask basic security fundamentals. If you’re building a platform that promises rapid development, make sure the underlying security model isn’t a footnote. Otherwise, you’ll end up like SpaceXSI – exposing your own playbooks to the world while trying to sell a shiny new tool.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: Ars Technica; arstechnica.com; Global1.News (11 November 2026).

By Allan Ali, Global1.News