The problem lies in a seemingly small design issue: how to spell the URL.
Grok Build is an AI programming agent owned by SpaceXSI. After users complete an application, they can generate a link and share it. Security firm Claroc found that these links placed the random identifier on the far left side of the domain name, where the subdomain is located.
A subdomain name has a characteristic: as long as someone visits it, it will leave a record in the passive DNS database. This type of database is publicly searchable and is used every day by the security industry. So the attacker doesn't need to guess. He can go directly to the DNS records to list these subdomain names one by one and open them one by one.
What was uncovered was terrifying: internal business plans, financial plans, employee lists, and medical records. Thousands of users were affected, including SpaceXSI's own confidential documents. In the materials seen by the media, the salary and performance data of SpaceX and Tesla are included.
Compare common practices. Most collaboration tools will put random strings in the path, such as example.com/share/xxxx. The path will not be entered into DNS records, making it much more difficult for outsiders to enumerate. Grok Build chose another way of writing, which is equivalent to actively posting the house number on the bulletin board.
SpaceXSI is now deleting relevant links. Claroc's advice is simple: manually change the permissions to "invites only" when sharing the app, and don't use the default public link.
If you have used Grok Build or other Grok-based tools to share things, it is best to go back and close all old links now. Deleting the link can only prevent it in the future, and the content that has been crawled cannot be recovered.
AI programming tools have lowered the threshold for "making an application" to just a few minutes, but the security default value is still stuck at the stage of "first being able to use it". What happened this time was not the model, but the most basic engineering common sense.