Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Summary
Security firm Claroc found that a flaw in Grok Build’s share links let people discover thousands of live projects and view their contents. Exposed material included personal, medical, and business information from users and companies, including SpaceXSI; SpaceXSI removed links to its 24 identified apps after Ars sent questions.Key Facts
- Grok Build uses randomized share URLs, but Claroc said a design flaw made it possible to enumerate thousands of live projects.
- In most cases, opening a discovered link revealed data associated with the app.
- Claroc found 24 exposed apps built by SpaceXSI, including an onboarding plan, a sales territory map, internal tool addresses, and advertising proposals.
- Other exposed data included medical exam records, employee names and ID numbers, business proposals, customer details, and pricing information.
- Claroc identified exposed projects associated with organizations including Tesla, a Navy logistics contractor, a healthcare company, and an aerospace and defense group.
- Claroc said it notified SpaceXSI on Sunday; the article reports that SpaceXSI removed links to the 24 apps after Ars asked questions.
- Claroc co-founder and CTO Asaf Aprozper said the firm was working to notify affected companies.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
