A Grok vibe-coding agent leaked sensitive SpaceXSI data

A flaw in SpaceXSI’s Grok Build coding agent exposed sensitive information from thousands of users, including material belonging to SpaceXSI, a hospital group and a fire department. The incident matters because links intended to be difficult to guess could be found through public DNS records, leaving some company documents accessible to anyone who obtained them.

Security firm Claroc said SpaceXSI’s exposed material included an onboarding plan, a sales map covering 594 strategic accounts, eight advertising proposals, four live advertiser account boards and two brand safety playbooks. It also found exposed apps at six Fortune 500 companies and 26 organisations with more than 1,000 employees; Claroc estimated about two per cent of the material it found was high or critical risk. SpaceXSI removed 24 of its own apps after Claroc publicly raised the issue, but Claroc said other organisations’ exposed apps remained available.