Security firm Claroc identified a vulnerability in the Grok Build platform that exposed sensitive data from thousands of projects. The issue stems from a design flaw where randomized URL segments are placed as subdomains rather than paths, allowing them to be indexed by passive DNS services.
Claroc discovered 43 601 links ending in grok.me, with nearly 95 percent of them publicly accessible. Exposed information included internal business plans, medical records, and employee data from various organizations, including Fortune 500 companies and a defense contractor.
The breach affected 24 internal apps developed by SpaceXSI, the entity formed by the merger of SpaceX and xAI. These apps leaked confidential documents, such as sales territory maps containing 594 accounts and onboarding plans for enterprise sales staff.
SpaceXSI began removing the compromised links shortly after being contacted by reporters. While a representative for Cursor, a service acquired by SpaceXSI, claimed that apps are private by default, security researchers stated that Grok Build defaults to public access unless users manually change settings.
Other AI coding platforms like Lovable, Bolt, and Replit were also noted to use similar URL structures that may expose data. Conversely, platforms such as Claude, ChatGPT, and Gemini utilize path-based security, which prevents DNS-based discovery of shared links.
