A Grok Vibe-Coding Agent Leaked Sensitive SpaceXSI Data

A flaw in SpaceXSI's Grok Build vibe-coding agent exposed sensitive data from thousands of users, including SpaceXSI itself, according to security firm Claroc. The issue stemmed from how Grok Build generated app links: it placed randomly generated four-word phrases with up to 38 bits of entropy to the left of the domain rather than the right, allowing passive DNS servers to discover and index the links publicly. Among the affected organizations were a hospital group, a fire department, and six Fortune 500 companies, with 26 exposed companies employing more than 1,000 people; Claroc estimated roughly 2% of exposed material was serious enough to rate high or critical. SpaceXSI reportedly did not respond until Claroc tagged Musk and another official on X, after which the company took down 24 of its own exposed apps. Watch for whether SpaceXSI broadens its remediation and whether other Grok Build customers audit their own link configurations.