Grok Build share links leave about 35,000 vibe-coded apps open, including SpaceXSI's own internal files
Security firm Claroc found it could enumerate live Grok Build apps and open their data, from business plans to medical exam results; SpaceXSI pulled its own 24 exposed apps after Ars Technica asked, but most other data stayed reachable.
Why it matters
Vibe-coding tools let people publish working apps in minutes, and this case shows the security cost when sharing defaults are weak. Grok Build randomises share URLs, but a design decision made thousands of live projects discoverable, so anyone could find them. The exposure reached SpaceXSI's own sales material and, according to Claroc, apps from Fortune 500 staff and a defence contractor. Claroc says SpaceXSI did not answer its Sunday notice. Watch for a fix to how share links are published, notifications to affected companies, and whether regulators treat exposed medical records as a reportable breach.
Key facts
- Researcher: security firm Claroc
- About 35,000 Grok Build apps open to anyone who looked
- 24 exposed apps were built by SpaceXSI itself
- Exposed: onboarding plan, 594-account sales territory map, ad proposals
- Claroc notified SpaceXSI on Sunday
- SpaceXSI removed its 24 app links after Ars Technica's questions