SpaceXSI Withdraws 24 Grok Applications After Link Vulnerability

Internal applications and documents have been made accessible via Grok links discovered by passive DNS services. According to Claroc, thousands of users are affected, including SpaceXSI. The company has removed 24 of its own applications following a public alert, but has not closed those of other organizations.

SpaceXSI removes 24 applications but leaves others open

SpaceXSI has removed 24 of its own applications that were exposed through Grok links. Claroc indicates that the company did not take similar action for the applications that remained open from other Grok users and organizations. According to Claroc, SpaceXSI did not respond until Musk and another company official were mentioned on X. Claroc informed SpaceXSI and other affected companies of its findings, and some organizations acted quickly to limit exposure.

Exposed documents and scope: Fortune 500 and employee data

This leak has affected several thousand users, including SpaceXSI. Sensitive employee data has been made public, originating from a hospital group, a fire department, and SpaceXSI. Only one of the affected applications required a password entry. Six of the involved companies were part of the Fortune 500 ranking, and 26 had more than 1,000 employees. Claroc estimates that about two percent of the cases involved documents deemed high or critical. Researchers referred to these pages as GhostShares, as they were accessible and viewable by anyone, even without having received the link. They also noted that internal resources of the company that publishes Grok were open to anyone who had the URL. Regarding SpaceXSI, the publicly available files included an integration plan, a sales territory map covering 594 strategic accounts, eight advertising offers on X, four active advertising account spreadsheets, and two copies of a brand X security manual.

The design of Grok Build links allowed for passive indexing

Grok Build generated links from random four-word phrases, offering up to 38 bits of entropy. According to Claroc, the secret part of the link was placed to the left of the domain, while Google Gemini places it to the right. This choice, combined with Grok's link management, allowed passive DNS servers to discover these URLs and register them in publicly accessible databases.