[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-grok-build-share-links-expose-data-from-thousands-of-projects":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12792,"grok-build-share-links-expose-data-from-thousands-of-projects","Grok Build Share Links Expose Data From Thousands of Projects","Claroc researchers say Grok Build's share links can be listed and opened, exposing business plans, medical results and 24 SpaceXSI apps.","Anyone who has shared an app built with Grok Build should check what data sits inside it. Research from security firm Claroc found that, except in rare cases, opening a shared link reveals everything attached to the app, and that outsiders can find those links in bulk.\n\nGrok Build is SpaceXSI's vibe-coding agent, an AI tool that builds apps from plain-language instructions. SpaceXSI is the name of the now-merged SpaceX and xAI. Users can share their apps through links, and the platform randomizes the URLs so that only people who know the exact address can get in. According to the research, a design decision by the platform's developers defeats that protection. It lets anyone enumerate, meaning list one after another, thousands of live projects.\n\nThe exposed material includes internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers.\n\nSpaceXSI's own apps are in the mix too. Claroc found 24 of them. They include an onboarding plan, marked confidential, for a new member of the enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals. The research summary we reviewed includes no response from SpaceXSI.\n\nThe pattern is familiar. Sharing by unguessable link treats the link as a password, and that only holds if outsiders cannot list the links. Randomizing an address does little if the platform lets strangers enumerate them. The fault, as the researchers describe it, sits in the platform's design rather than in anything users did.\n\nVibe-coding tools also draw people who do not write code for a living, and they may not think of a shared app as a public page. Cruise galley checklists and medical results suggest that many users treated these apps as private workspaces.","[\"grok-build\",\"spacexsi\",\"data-exposure\",\"vibe-coding\"]","2026-11-10T21:12:59.000Z","2026-11-10T22:31:59.931Z","2026-11-10T22:32:00.119Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the unsupported inference that SpaceXSI's 'own sales team did not catch the exposure' (the source only says 24 company-built apps contained sales-related files, not who built or reviewed them), and drop the 'not clear from the research' line about whether the company fixed it, which reads as an open question. Say plainly whether SpaceXSI responded, and soften the lede's 'assume the data is readable by strangers' to match the source's 'except in rare cases'.","resolved","security",[32,33,34,35],"grok-build","spacexsi","data-exposure","vibe-coding",[37],{"name":38,"url":39},"Ars Technica","https:\u002F\u002Farstechnica.com\u002Fsecurity\u002F2026\u002F11\u002Fgrok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi\u002F",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7144,"2026-11-12T13:27:45.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1128,"2026-11-11T18:05:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Deals","deals",642,"2026-11-12T14:00:00.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Policy","policy",619,"2026-11-12T12:53:36.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",364,"2026-11-12T11:12:32.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Hardware","hardware",336,"2026-11-12T11:24:43.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",230,"2026-11-12T10:00:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",168,"2026-11-11T17:36:49.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",159,"2026-11-11T12:30:00.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",118,"2026-11-11T16:49:42.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",107,"2026-11-12T10:09:03.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]