Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI

7.9 relevance

Security leak in AI coding agent, directly relevant to AI/ML tooling and platform security.

AI/ML arstechnica.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a platform engineer evaluating AI coding agents, this incident highlights critical security risks in default-sharing patterns and the need for rigorous access control audits before adopting such tools in sensitive environments.

Key Takeaways

Audit any AI coding agent's data-sharing defaults and enforce authentication for all shared resources, especially when handling internal business or PII data.

Summary

Grok Build, the vibe-coding agent from SpaceXSI, leaks sensitive data from thousands of users through enumerable share URLs, a design flaw that undermines access randomization. Claroc research reveals exposed data includes internal SpaceXSI sales plans, Tesla employee scorecards, and medical exams from a Peruvian construction firm, among other proprietary information from Fortune 500 companies and defense contractors. SpaceXSI only began removing its own 24 exposed apps after Ars Technica inquired, leaving other users' data still accessible at time of publication.

Author

Dan Goodin — Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. A journalist with more than 25 years experience, he has been chronicling the...