Grok Build share links exposed SpaceXSI data and other companies' apps

[MessiGOAT21]

A vibe coding tool has left sensitive information open to anyone who knew where to look. Engadget reports that security firm Claroc found Grok Build's share links exposed data from thousands of users, including SpaceXSI itself

The links used four dice words, giving up to 38 bits of randomness, placed to the left of the domain name. That meant passive DNS records swept them into public databases, whereas Gemini places similar identifiers to the right where they are not exposed

Leaked SpaceXSI material included a sales map of 594 strategic accounts and eight X advertising proposals. Six Fortune 500 companies, a hospital group and a fire department were among those affected, and Claroc calls the exposed pages GhostShares

SpaceXSI reportedly removed 24 of its own apps only after Elon Musk was tagged on X, but other users' apps reportedly remain exposed. The findings come from the researchers

Share links are convenient, but this shows how a small design choice can expose a lot of data. Putting identifiers where DNS records capture them is an easy mistake with big consequences. Anyone using vibe coding tools should check what their share links reveal

Do you use share links for sensitive work? And how can AI coding tools be made more secure?

A Grok vibe-coding agent leaked sensitive SpaceXSI data - Engadgetwww.engadget.com