Grok Build's Data Leak: What You Need to Know

Grok Build data leak is real. It's spilling confidential data. Thousands of users are affected. This isn't some abstract security alert; the vibe-coding agent from SpaceXSI, the platform itself, is exposing proprietary business information and sensitive secrets, which researchers recently uncovered through shared app links intended for collaboration but instead revealing everything. The platform is failing.

Your Secrets Exposed: The Grok Build Flaw

Tools speed your workflow. Grok Build lets you input text or speech, getting a working app in minutes. That's quick. The concept itself is undeniably brilliant, since you can simply share a link, and then collaborators, wherever they are, are able to quickly test your creation. But there's a critical flaw in how this works.

SpaceXSI developers tried to make these shared links secure by randomizing them. They use "dice words" like "cinder-crane-sand-frost" followed by grok.me. The goal? To make these URLs impossible to guess, operating on a principle called capability-based access control. Possession of the link should be your only key.

Here's the problem. Those "dice words," that randomness, sit left of the domain. It's not minor. Security firm Claroc identified this fundamental design choice as completely torpedoing the entire security objective because, instead of being hidden like the randomized parts of a Google Docs link, Grok Build's exposed random sections are readily available to passive DNS services. This exposure is a major vulnerability.

What does that mean for you? These services constantly monitor central DNS lookup servers. When a new Grok Build link is created and accessed, that lookup is captured. It becomes publicly searchable. It's like leaving your front door key under the doormat, then being shocked when someone finds it. This allows anyone to enumerate thousands of live Grok Build projects, effectively making them public.

The Shocking Scale of the Spill

Claroc's research paints a stark picture. Forty-three thousand, six hundred and one links, all concluding with grok.me, appeared in a passive DNS search, a staggering number, and of those, an overwhelming majority, constituting nearly 95 percent, were publicly accessible. Clicking them opened the app. And all its stored data. That's nearly every shared Grok Build app an open book, accessible to anyone. Think about that for a second.

It's deeply ironic. Some of the most sensitive data belonged to SpaceXSI itself. And Claroc found two-dozen applications, all of which had been built by the company, that were unambiguously leaking information, much of it highly sensitive.

• An onboarding plan, marked confidential, for a new enterprise sales team member.
• A sales territory map with 594 accounts.
• Internal system addresses for sales team tools.
• Advertising proposals.

This isn't just theoretical. This is real, sensitive company intel that was out in the wild. We were shocked," Claroc said in a Tuesday post. "The company that makes Grok had its own internal material open to anyone holding the link, and we had never been given it. Had the sales team bought a tool for this, it would have sat behind company sign-in, open only to the team. Built with AI, it went live open to anyone with the link."

Who Is Truly Affected?

The Grok Build data leak isn't limited to SpaceXSI's internal operations; Claroc discovered sensitive data belonging to various other users, including Fortune 500 companies and a defense contractor, indicating a far wider problem. And it's personal for many.

Here’s a quick glance at some of the exposed data:

• A Peruvian construction company: An occupational-health dashboard containing 3,784 worker medical exams.
• Tesla: A service-center scorecard listing 22 technicians with their productivity and bonus status.
• A US-Navy ship engineering contractor: A roster of 108 people working on a Navy logistics support contract.
• A leading luxury cruise company: A galley checklist for a celebrity cruise line, detailing crew by full name and employee ID.
• A healthcare company: A hospital staff app with a roster of about 3,565 employees, including names and IDs.
• A US IT services company: A confidential proposal to a major retail customer, including the hardware bill of materials.
• A Norwegian-Finnish aerospace and defense group: A load board and loading procedure for an explosives building at a US plant, plus its HSE training matrix.
• A US home construction company: A sales callsheet with around 583 home-buyer prospects, their budgets, and financing notes.

Asaf Aprozper, co-founder and CTO of Claroc, is currently notifying affected companies. The impact is immediate. After he spoke to the CISO of the luxury cruise company, they "pulled in their whole security team as soon as we shared the findings and are already working to contain the Grok exposure."

SpaceXSI did begin removing its own leaked links after questions were raised, but the sheer volume of other exposed data remains a massive concern. The critical detail? Aprozper’s tests showed that, by default, Grok Build set shared links to "Anyone with the link." A representative from Cursor, which SpaceXSI recently acquired, stated that Grok Build apps are "private by default unless the creator chooses to share it." This contradicts the findings directly.

Your Action Plan: What This Means for You

This isn't just about Grok Build.

This is a wake-up call for anyone using AI coding agents that offer link-sharing. Aprozper noted that other platforms like Lovable, Bolt, and Replit also give each app its own web address, making them potentially vulnerable to the same passive DNS exposure. However, he emphasized that "Grok is where we found by far the most sensitive company data."

Your links are public. You must assume this default setting remains unless you've explicitly changed it, and with Grok Build, you've got the critical option to modify the access from "Anyone with the link" to "invited users" or simply "only you." Change it now. And if you're building anything sensitive, such as client data, internal plans, or employee information, you absolutely must change that default.

Link sharing works. Claude's artifacts, ChatGPT's conversations, and Gemini all handle it. Their inherent randomness bypasses DNS services, meaning they don't see the actual paths, which represents the most secure method for protecting your sensitive data from being enumerated. This method is decidedly secure. It prevents your data from being cataloged.

The Verdict: Check Your Settings Now

Grok Build’s data leak. It's a stark reminder, showing convenience frequently carries hidden risks that demand our immediate attention. Don't blindly trust default settings for data privacy; actively manage them. If you've utilized Grok Build's shareable links, you must immediately access your projects and meticulously verify your privacy configurations to safeguard your sensitive information. Opt for the "invite others" function unless you truly desire your application to be publicly accessible to a broad audience worldwide. Your sensitive data depends on this vigilance.

Frequently Asked Questions

What is the Grok Build data leak?

The Grok Build data leak is a real incident where the platform, a vibe-coding agent from SpaceXSI, is exposing proprietary business information and sensitive secrets. This occurs because shared app links, intended for collaboration, are revealing confidential data to passive DNS services.

How does Grok Build's security flaw work, according to the article?

Grok Build's security flaw lies in how its shared links are structured, with randomized "dice words" appearing left of the domain. This exposure to passive DNS services means that when a link is created and accessed, the lookup is captured and becomes publicly searchable, effectively making thousands of live projects accessible.

What was the scale of the Grok Build data leak discovered by Claroc?

Claroc's research found 43,601 links concluding with grok.me in a passive DNS search, with nearly 95 percent of them being publicly accessible. Clicking these links opened the app and all its stored data, indicating that almost every shared Grok Build app was exposed.

Who has been affected by the Grok Build data leak?

The Grok Build data leak has affected thousands of users, including SpaceXSI itself, Fortune 500 companies, and a defense contractor. Examples of exposed sensitive data include worker medical exams, sales territory maps, and confidential proposals.

What action should users take regarding their Grok Build links?

Users must immediately access their Grok Build projects and verify their privacy configurations, assuming the default setting of "Anyone with the link" remains unless explicitly changed. It is recommended to change this to "invited users" or "only you" to safeguard sensitive information.