Get the app

Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI

Ars Technica
Read full story· 2 min
Security researcher Aprozper found that Grok Build, an AI coding service acquired by SpaceXSI, exposed over 35,000 apps publicly by default, leaking sensitive company data. This contradicts Cursor's claim that apps are private unless shared deliberately. Other AI coding platforms also use shareable links but with better privacy practices.

What happened

A security researcher named Aprozper discovered that Grok Build, an AI coding service now owned by SpaceXSI, made over 35,000 apps accessible to the public by default. This exposure allowed anyone with the link to view the apps and their stored data, including sensitive company information. The default sharing setting was set to 'Anyone with the link,' unless users manually changed it. This finding contradicts a statement from Cursor, the service's previous owner, which claimed that apps are private unless the creator chooses to share them.

Key details

  • Aprozper found 43,601 grok.me links, with over 35,000 publicly accessible.
  • Grok Build's default setting is 'Anyone with the link' for app sharing.
  • Users can change sharing to 'invited users' or 'only you.'
  • Cursor, now part of SpaceXSI, claimed apps are private by default.
  • Other AI coding platforms like ChatGPT, Lovable, and Bolt also use shareable links but have more secure privacy practices.

Why it matters

Organizations and individuals using Grok Build may have unintentionally exposed confidential data, including proprietary company information, to the public. This creates potential risks for SpaceXSI and its customers, who may need to review and update their app sharing settings to prevent further leaks. Users of similar AI coding platforms face a decision about how to manage link sharing to protect sensitive information.

#chatgpt#cursor#data-privacy#grok-build#lovable#software-security#spacexsi

More in Cybersecurity