Anyone who has shared an app built with Grok Build should check what data sits inside it. Research from security firm Claroc found that, except in rare cases, opening a shared link reveals everything attached to the app, and that outsiders can find those links in bulk.
Grok Build is SpaceXSI's vibe-coding agent, an AI tool that builds apps from plain-language instructions. SpaceXSI is the name of the now-merged SpaceX and xAI. Users can share their apps through links, and the platform randomizes the URLs so that only people who know the exact address can get in. According to the research, a design decision by the platform's developers defeats that protection. It lets anyone enumerate, meaning list one after another, thousands of live projects.
The exposed material includes internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers.
SpaceXSI's own apps are in the mix too. Claroc found 24 of them. They include an onboarding plan, marked confidential, for a new member of the enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals. The research summary we reviewed includes no response from SpaceXSI.
The pattern is familiar. Sharing by unguessable link treats the link as a password, and that only holds if outsiders cannot list the links. Randomizing an address does little if the platform lets strangers enumerate them. The fault, as the researchers describe it, sits in the platform's design rather than in anything users did.
Vibe-coding tools also draw people who do not write code for a living, and they may not think of a shared app as a public page. Cruise galley checklists and medical results suggest that many users treated these apps as private workspaces.