Grok Build vulnerability exposed access to data — Engadget

A vulnerability in the vibe-coding agent Grok Build could have exposed sensitive data of thousands of users, including internal SpaceXSI materials. This was stated by security company Claroc, Engadget reports.

How the links became accessible

According to Claroc researchers, Grok Build generated application links using random four-word phrases with up to 38 bits of entropy. At the same time, this part of the address was placed to the left of the domain rather than to the right, as in Google’s Gemini.

Because of this structure, the addresses could be recorded by passive DNS servers. They subsequently appeared in publicly available databases, where they could be found by people to whom the links had not originally been sent. Researchers called such pages GhostShares.

More current news is available on the UA.News Telegram channel Telegram.

What materials were exposed

Among the discovered SpaceXSI materials were an onboarding plan for new employees, a sales territory map for 594 strategic accounts, eight X advertising proposals, four active advertiser account dashboards, and two copies of X’s brand safety guide. Only one of the discovered applications required a password.

Claroc also reported that among the organizations whose data could have been exposed, six were included in the Fortune 500 list and 26 had more than 1,000 employees. According to the researchers’ estimate, about 2% of the discovered applications contained materials with a high or critical level of sensitivity.

The company shared its findings with SpaceXSI and other affected organizations. According to Claroc, some of them quickly restricted access to the applications. SpaceXSI, researchers claim, responded after Elon Musk and another company representative were mentioned on X and removed 24 of its own applications from access.