An AI coding tool built by a company that sells itself on frontier engineering leaked that company’s own internal files. That’s the short version of what security firm Claroc told Ars Technica about Grok Build, SpaceXSI’s vibe-coding agent.
The flaw is in how Grok Build creates links to the apps it generates. Each link uses “dice words,” a randomly generated four-word phrase with up to 38 bits of entropy. That’s not a terrible idea on its own. But Grok put the phrase to the left of the domain, as a subdomain, instead of to the right as a path, which is what Google’s Gemini does. Subdomains show up in DNS lookups. Passive DNS services collect those lookups and publish them in searchable databases. So a link meant to be private became something anyone could find without ever being given it.
Claroc calls these pages GhostShares. “We were shocked,” the researchers wrote. “The company that makes Grok had its own internal material open to anyone holding the link.” Except, in practice, you didn’t even need to hold it.
The SpaceXSI material included an onboarding plan, a sales territory map of 594 strategic accounts, eight X advertising proposals, four live advertiser account boards and two copies of an X brand safety playbook. Only one of the exposed apps asked for a password. Beyond SpaceXSI, employee-related information leaked from a hospital group and a fire department. Six other exposed companies are in the Fortune 500, and 26 have more than 1,000 employees. Claroc estimates roughly two percent of the material was serious enough to rate high or critical.
Here’s why this matters. Security by unguessable URL is already a weak model, because links get pasted into chats, logged by proxies and scraped by crawlers. Leaking them through DNS makes it worse, and it’s a design choice, not an exotic bug. Vibe-coding tools invite non-engineers to build and publish apps quickly, and those users reasonably assume the platform handles basic exposure risks. Nobody should have to know what passive DNS is to avoid publishing their employee data.
The response is also worth scrutiny. Claroc shared its findings with SpaceXSI and the affected companies, and some of them moved fast. SpaceXSI reportedly didn’t reply until Claroc tagged Musk and another company official on X. It then took down 24 of its own exposed apps, but “it has not done the same for the apps other Grok users and organizations left open,” Claroc wrote.
That last detail is the one to remember. If you’ve built anything with Grok Build, assume the link is public, put real authentication in front of it, and rotate anything sensitive it touched. Waiting for the vendor to fix it for you has not worked so far.