Data Exposure of Thousands of Grok Build Users by SpaceXSI Uncovered by Claroc via Public Links

Security Flaw Discovered in SpaceXSI’s Grok Build Platform

According to НВ — Техно: Claroc, a cybersecurity firm, has uncovered a significant security flaw within SpaceXSI’s Grok Build, a service designed for rapid app development. This vulnerability exposed thousands of users’ data through publicly accessible links. Their investigation revealed 43,600 links hosted on the grok.me domain, with over 35,000 (nearly 95%) being publicly available by default. Grok Build’s settings allow anyone with a link to access projects without restrictions.

Details of Exposed Projects

The publicly accessible projects included highly sensitive and confidential information such as:

• 24 applications created by SpaceXSI, which resulted from the merger of SpaceX and xAI.
• Internal documents including an onboarding plan for a new corporate sales manager, a client territory map covering 594 customers, and marketing proposals.
• Performance ratings from a Tesla service center, detailing bonuses for 22 technicians.
• A roster of 108 employees working for a U.S. Navy contractor.
• Medical examination results for 3,784 employees of a Peruvian construction company.
• Personal data of 3,565 hospital staff members.

Claroc reported this issue to SpaceXSI on Sunday. After receiving no response, Claroc tagged Elon Musk and Grok’s CEO Matt Palmer on the social media platform X. Within hours of a query by Ars Technica, the SpaceXSI applications were removed from public reach. Cursor, the service’s representative, denied claims that Grok Build projects are private by default. However, technical tests led by Claroc’s CTO Asaf Aprozper confirmed these denials were inaccurate.

The root cause involves how Grok Build embeds random words to protect links: these words are placed before the domain name, causing them to appear in publicly accessible passive DNS databases. In contrast, competitors like Claude, ChatGPT, and Gemini position these random elements after the domain, rendering them invisible to DNS records. Claroc emphasized this by stating,

"The company behind Grok had its own internal materials accessible to anyone with a link, which we were never given."

This discovery highlights the critical need for robust data privacy measures in today’s digital landscape. Exposing sensitive information publicly can have severe repercussions for both organizations and individuals involved. Furthermore, this incident raises questions about the security protocols employed by similar platforms and may prompt companies to reassess their data protection strategies. How SpaceXSI handles this breach moving forward could set an important example for other tech firms regarding data security.

The recent data exposure incident involving SpaceXSI’s Grok Build raises significant concerns about user privacy and security in tech platforms. This is not the first time vulnerabilities have been highlighted in high-profile technologies; for instance, Discover-Tech tracked Starlink users across numerous countries, including regions with restricted access. Such occurrences underline the critical need for robust security measures in the development of digital services.