Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
摘要
安全公司Claroc的研究显示，SpaceXSI旗下的编程代理Grok Build通过分享链接泄露了数千名用户的敏感数据，包括内部商业计划、广告提案、医疗检查结果及员工姓名和工号等。尽管平台对链接URL进行了随机化处理，但开发者的设计决策使任何人都能枚举大量在线项目并访问相关数据。泄露数据中还包括SpaceXSI自身构建的约24个应用中的机密信息，如新员工入
Grok Build, the vibe-coding agent from SpaceXSI, is leaking data—some of it proprietary business information and other sensitive secrets—from thousands of its users, including the very same Elon Musk-owned company that offers the platform, new research shows.
The information is revealed through links allowing Grok Build users to share their apps with others. Grok takes steps to randomize the URLs so only people who know the exact URL can access the data stored there. A design decision by developers of the platform, however, completely torpedoes that objective and makes it possible for anyone to enumerate thousands of live Grok Build projects. Except in rare cases, clicking those links opens the app and reveals all data associated with it.
You had one job
Research from security firm Claroc shows that the exposed data includes things like internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers. Ironically, some of the sensitive data comes from two-dozen apps built by SpaceXSI (the name of the now-merged SpaceX and xAI) itself. A small sampling of the documents revealed in the SpaceXSI apps—Claroc found 24 of them—include an onboarding plan, marked confidential, for a new member of SpaceXSI’s enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals.
转载信息
评论 (0)
暂无评论，来留下第一条评论吧