Security Flaw in SpaceXSI's Grok Build Exposes Sensitive Data of Thousands of Users
A security vulnerability in Grok Build, an AI-powered application development tool owned by Elon Musk's company SpaceXSI, has exposed sensitive information belonging to thousands of users online.
In a report, cybersecurity research firm Claroc said the vulnerability had exposed confidential information from various hospitals and fire departments, along with internal documents belonging to SpaceXSI itself.
Researchers have dubbed these unsecured pages ‘Ghostshares’. The name reflects the fact that anyone on the internet could easily discover and access these applications and pages, even without having their links.
How the Security Vulnerability Occurred
Users typically create applications through Grok by providing instructions to artificial intelligence, a process commonly known as ‘vibe coding’. Although the Grok Build tool generates links using random four-word phrases, it places this random component to the left of the website's domain name as a subdomain, rather than to the right.
Google's Gemini and other platforms protect privacy by placing such random identifiers to the right of the domain name. However, Grok's use of the subdomain approach allowed passive DNS servers to easily record these links, which subsequently became searchable through publicly accessible databases.
Details of the Exposed Information
After analysing more than 35,000 publicly accessible Grok applications, Claroc researchers reported that approximately 10 percent contained sensitive or business-related data, while at least 2 percent included highly sensitive information.
Among the exposed confidential information belonging to SpaceXSI were new employee onboarding plans, sales maps covering 594 strategic accounts, advertising proposals for X (formerly Twitter), live account boards and brand safety playbooks.
In addition, pages containing lists of more than 3,500 employees of a hospital group, fire department shift rosters, and employee usernames and passwords were also left exposed.
SpaceXSI's Response
Although Claroc immediately notified SpaceXSI about the data exposure, the company initially did not respond.
Later, after Elon Musk and relevant officials were tagged in posts on social media platform X, the company took action and removed 24 of its own exposed internal applications.
However, researchers said no coordinated action had yet been taken to address unsecured applications belonging to other users and organisations.
//DBTech/BMT/OR//
