What changed
A security researcher from Claroc discovered that Grok Build, an AI coding platform developed by SpaceXSI, is leaking sensitive data from thousands of users. The issue arises from how shared links are structured, allowing public access to confidential information. The exposed data includes internal business plans, ad proposals, medical exam results, and employee details from various organizations, including SpaceXSI itself.
What this means in practice
The flaw allows anyone with the link to access data stored in Grok Build apps. A design decision by the platform's developers made it possible for passive DNS services to enumerate thousands of live projects.
Clicking on these links opens the app and reveals all data associated with it. The data includes internal business plans, ad proposals, medical exam results, and employee details from various organizations, including SpaceXSI itself.
Limitations and availability
The issue is not limited to SpaceXSI; other users, including Fortune 500 companies and a defense contractor, are also affected. The data exposed includes occupational-health dashboards, service-center scorecards, and confidential IP transit proposals.
SpaceXSI began removing the links within a few hours of Ars sending an email with questions for this article. At the time this post went live, links for all 24 apps returned an 'app not found' error.
The flaw stems from how SpaceXSI implemented the link-sharing mechanism. Instead of placing the randomness to the right of the domain, as Google does, Grok Build places it to the left, making the links easily guessable.
Passive DNS services can enumerate these links, exposing sensitive data. The company's representative stated that apps are private by default and nothing goes public unless the creator chooses to share it.
However, tests showed that by default, Grok Build sets links to 'Anyone with the link.' Users have the option to change the setting to 'invited users' or 'only you.'
The issue highlights a common flaw in AI platforms that use link-sharing for app development. Platforms like Claude, ChatGPT, and Gemini follow a secure approach by placing the secret randomness in the path, making DNS records invisible to passive searchers.
However, Grok Build is where the most sensitive company data was found, indicating that users of other platforms are also at risk.
