The company that sells an AI coding agent leaked its own sales map, ad proposals and brand safety playbook through that agent. That is the headline from a security report on Grok Build, and it’s an embarrassing one for SpaceXSI.
According to Engadget, which cited Claroc’s findings as first told to Ars Technica, a flaw in how Grok Build creates links to the apps it builds let those apps be exposed publicly. Thousands of users were affected. Sensitive employee-related information leaked from a hospital group and a fire department, and SpaceXSI’s own material was exposed too. Claroc calls these open pages GhostShares, because people who were never given the link can still find and open them.
The SpaceXSI material is not trivial. Claroc found an onboarding plan, a sales territory map of 594 strategic accounts, eight X advertising proposals, four live advertiser account boards and two copies of an X brand safety playbook. Only one of the exposed apps asked for a password. Six other exposed companies are in the Fortune 500, and 26 have more than 1,000 employees. Claroc estimates about two percent of the material was serious enough to rate high or critical.
The cause is a small design choice. Grok Build builds links from “dice words,” four randomly generated words with up to 38 bits of entropy. But it puts that string to the left of the domain, as a subdomain. Google’s Gemini puts it to the right, in the path. Subdomains show up in passive DNS data, which feeds publicly searchable databases. So the secret in the link wasn’t secret for long.
This matters beyond one bug. Vibe-coding agents from Replit, Lovable, Vercel’s v0 and Google are all racing to turn a prompt into a hosted app in minutes. The convenience depends on sharing by link, and “unlisted” links are often treated as if they were access control. They aren’t. 38 bits of entropy is also modest for anything holding business data, even when the link is hidden properly. Anyone building with these tools should assume a shared link can leak and put real authentication on anything internal.
The response is the other sore spot. Claroc says SpaceXSI didn’t reply until the researchers tagged Musk and another company official on X. SpaceXSI then took down 24 of its own exposed apps, but Claroc says it hasn’t done the same for apps belonging to other Grok users and organizations. Some affected companies moved quickly on their own.
My read: this is not noise. It’s a basic architecture mistake, and the vendor was exposed by it. If you use Grok Build, audit what you’ve published and lock it down now. If you’re comparing agents, ask how each one handles link privacy before you ask about model quality.
