Key points
- Claroc identified 35,000 publicly accessible Grok Build applications.
- Twenty-four apps belonging to SpaceXSI contained confidential business data.
- The platform relies on URL obscurity rather than authentication for access control.
Security firm Claroc reported that thirty-five thousand applications created with SpaceXSI’s Grok Build coding agent were accessible to anyone who could guess their web addresses, according to the published report This exposure included sensitive material from the platform’s own parent organisation, revealing a significant gap in default privacy controls.reported
Evidence: reported
Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSIaifleet-ars
The evidence
Claroc’s research demonstrated that Grok Build users can share their projects via direct links, which the platform presents as a secure sharing mechanism. The system randomises these URLs to prevent casual discovery, relying on the assumption that only intended recipients will possess the exact address. However, Claroc found that developers could systematically enumerate these live projects, bypassing the intended obscurity.
The decision
The platform’s design allows any visitor with the correct link to view the full application and its associated data without requiring a login or additional verification. This architectural choice means that security depends entirely on the secrecy of the URL string rather than on identity-based access controls. Claroc noted that this approach differs from traditional enterprise tools, which typically sit behind organisational sign-in gates.
What the evidence means
The audit uncovered internal business plans, medical examination results, and employee identification numbers stored within these open applications. Data from a Peruvian construction firm included an occupational health dashboard containing three thousand seven hundred and eighty-four worker medical exams. Fortune 500 companies and defence contractors were also among the affected user base, highlighting the breadth of the exposure.
What builders can do with it
Developers using Grok Build can create applications that are shared via generated URLs, but the platform’s current design allows anyone with the link to access the data. Builders cannot rely on the URL randomisation to prevent enumeration, as Claroc demonstrated that live projects can be systematically found. The platform’s sharing mechanism reveals all associated data to anyone who clicks the link, offering no additional barriers to access.
Why it matters
- Policy readers must consider how platform design choices shift liability for data protection from the provider to the individual user.
- The incident demonstrates that AI-assisted coding tools may bypass traditional enterprise security workflows, such as mandatory sign-in for internal tools.
- The exposure of internal SpaceXSI documents highlights the risk of sensitive data being stored in externally accessible applications.
- Claroc’s findings suggest that URL obscurity may not be sufficient for protecting sensitive business information.
Topics: AI security, Grok Build, data privacy, SpaceXSI, Claroc
Updated
Story timeline
- 10 Nov 2026 Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
- 11 Nov 2026 xAI News page updated: Introducing Grok Bot 1.0
The strongest doubt
Counterpoint from the sources
SpaceXSI began removing the links to its exposed internal apps within hours of being contacted by reporters, mitigating the immediate risk for those specific documents.
For readers
Policy
- Platform design choices regarding URL obscurity may not meet enterprise security standards.
- The incident provides a case study in AI-assisted development security gaps.
Business
- Internal tools built with AI agents may bypass standard corporate security protocols.
- Organisations should audit externally facing applications created by non-technical staff.
Researchers
- Claroc’s findings highlight the risks of relying on randomness for security.
- The audit revealed sensitive data from Fortune 500 companies and defence contractors.
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Questions readers ask
How many apps were found to be publicly accessible?
Claroc identified thirty-five thousand Grok Build applications that were open to anyone with the URL.
Did SpaceXSI have its own data exposed?
Yes, twenty-four apps built by SpaceXSI contained confidential internal documents before the links were removed.
What type of data was leaked?
The exposed data included medical records, business plans, employee IDs, and internal system addresses.
Connected stories
Reading receipt
- Claroc identified 35,000 publicly accessible Grok Build applications.
- Twenty-four apps belonging to SpaceXSI contained confidential business data.
- The platform relies on URL obscurity rather than authentication for access control.