Security firm Claroc discovered that Grok Build, the vibe-coding agent from SpaceXSI (the merged SpaceX and xAI entity), exposes confidential data from thousands of user projects through enumerable share links. Although Grok randomizes URLs to restrict access to known link holders, a platform design flaw allows anyone to enumerate live projects, revealing all associated data upon access. Exposed information includes internal business plans, advertising proposals, medical exam results, cruise line galley checklists, and employee names and ID numbers. Critically, 24 apps built by SpaceXSI itself leaked proprietary material, such as a confidential onboarding plan for an enterprise sales hire, a sales territory map covering 594 accounts, internal system addresses for sales tools, and advertising proposals. Claroc notified SpaceXSI on Sunday; after no response, the firm publicly tagged Elon Musk and Grok Manager Matt Palmer on X. By Monday evening, all 24 SpaceXSI apps were still exposing data, but SpaceXSI began removing links within hours of Ars Technica's inquiry. At publication, all 24 SpaceXSI app links returned "app not found" errors, though most other user data remained accessible.