Security researchers have uncovered a critical flaw in SpaceXSI's Grok Build platform that has left over 35,000 shareable links open to public access, exposing confidential business plans, medical records, and proprietary data from the company itself and its users.
Claroc disclosed the vulnerability on Tuesday, Nov 10, 2026, after finding that the randomization of URLs placed left of the domain allowed passive DNS services to enumerate live projects. The exposed data included internal SpaceXSI sales materials, ad proposals, medical exam results, and employee IDs from users at Fortune 500 firms and a defense contractor. SpaceXSI began removing the affected links within hours of inquiry.
The flaw stems from a design choice that placed random "dice words" before the grok.me domain rather than after it, making the links guessable. Although Grok Build defaults to "anyone with the link," users can restrict access to "invited users" or keep apps private. Security experts warn that the breach highlights the risks of capability-based sharing when not implemented correctly.