Elon Musk's AI Coding Agent Is Bleeding SpaceX Secrets Through a Basic Design Flaw

An artificial intelligence coding tool meant to speed up software development is accidentally publishing internal corporate secrets and personal data for anyone to find. Security firm Claroc discovered that Grok Build exposes thousands of live user projects, including sensitive documents from SpaceXSI itself. While the platform randomizes sharing links to keep apps private, a developer design flaw lets outsiders easily guess or enumerate thousands of active project URLs.

That architectural oversight exposes more than just hobbyist code. The leaked files include internal business plans, medical exam results, celebrity cruise line checklists, and employee identification numbers. Claroc found two-dozen vulnerable applications tied directly to SpaceXSI, the merged entity of SpaceX and xAI. Those exposed corporate files range from a confidential onboarding plan for an enterprise sales hire to internal system addresses and a sales territory map tracking nearly six hundred accounts.

Our read is that relying on obscure URLs for security remains a fatal mistake in automated software deployment. Obscurity is never access control, especially when an algorithm generates or handles links predictably. SpaceXSI built a platform to automate app creation, but failed to secure the foundational data boundaries required for enterprise use.

Watchers should monitor whether similar vibe-coding agents rush to patch authorization checks before wider deployment exposes even deeper corporate infrastructure.