Grok Build Links Exposed Thousands of Projects, Including SpaceXSI Apps

Grok Build’s app-sharing links were designed to be difficult to guess, but a flaw in how the links were structured allowed passive DNS services to capture them. Those links could then appear in searchable databases, giving people who had not been invited access to projects and their associated data.

Claroc found exposed information connected to thousands of users. The material included business plans, advertising proposals, medical exam results, employee names and ID numbers, and checklists from a cruise line. The firm estimated that about 2 percent of the exposed material was serious enough to be rated high or critical. Six affected companies were Fortune 500 firms, and 26 had more than 1,000 employees.

Among the exposed projects were 24 made by SpaceXSI, the merged SpaceX and xAI company. Their contents included a confidential sales-team onboarding plan, a map covering 594 strategic accounts, advertising proposals, advertiser account boards and a playbook on brand safety for X. Just one exposed application required a password.

Claroc said it notified SpaceXSI and other affected companies. After the firm publicly tagged Elon Musk and Grok manager Matt Palmer, SpaceXSI removed links to its 24 apps; they then returned an “app not found” error. Claroc said other users’ and organizations’ exposed apps had not all been taken down.