An AI-powered application platform developed by Elon Musk’s SpaceXSI has exposed a massive trove of confidential data, ranging from internal business records to patient information. Security researchers from Claroc revealed that Grok Build apps created by users were widely accessible due to insecure default sharing settings and discoverable URLs. SpaceXSI was formed following the merger of SpaceX and xAI, and its Grok Build tool allows users to generate web applications instantly by describing what they want through a chat interface without writing code.
Once an app is ready, users can publish it directly from the chat interface, and the system assigns it a unique web address using the format .grok.me, where the name consists of four random words. While intended as a privacy measure, Claroc researchers discovered these addresses could easily be found via passive DNS services that index domain names observed in DNS traffic. Out of 43,601 addresses identified under grok.me, the investigation found that nearly 95 percent could be accessed without any authentication whatsoever.
Key takeaways
- Grok Build allowed users to create web applications instantly via a chat interface.
- Researchers found 43,601 addresses under grok.me using passive DNS services.
- Approximately 94.7 percent of the discovered apps lacked any authentication protection.
- SpaceXSI secured its own exposed apps within two days of being notified.
The root cause of the widespread data leak
The primary security flaw stemmed from how the platform handled user permissions during the publishing process. When users opted to publish an application, they were presented with three privacy choices: "Anyone with the link", "Invited Users", and "Only You". The system defaulted to "Anyone with the link", leading many creators to publish their sensitive applications without realizing the global exposure. Because creators frequently ignored these sharing settings, thousands of confidential databases and internal software tools remained wide open to anyone who stumbled upon the URL.
While many of the exposed applications were relatively harmless prototypes, calculators, or simple landing pages, approximately ten percent contained sensitive internal business information. Furthermore, about two percent exposed critical data severe enough to warrant high security ratings. The exposed records included a hospital employee directory with more than 3,500 names, an intensive care briefing containing real patient information, and a trucking company recruitment database listing over 1,000 individuals. An employee timesheet discovered in the leak also contained downloadable code with 18 accounts utilizing plaintext passwords, including administrator credentials.
SpaceXSI internal exposure and remediation efforts
Even SpaceXSI itself fell victim to the misconfiguration, exposing 24 internal applications. These leaked assets included onboarding plans, employee name lists, strategic account sales territory maps with pipeline details, and media plans featuring advertiser decks. One such deck included budget tiers and was marked as confidential for a United States federal agency, alongside seven campaign reports intended for global advertisers.
Claroc also tested whether visitors could modify data within the unsecured applications. They built two test apps, one of which allowed unauthenticated visitors to modify a shared contact database, while another automatically granted access to any user signing in with a Google account regardless of team membership. Following formal notification on November 8, SpaceXSI removed all of its own exposed applications within two days and began working through the broader list of affected creators to notify them of the vulnerabilities.
Comments