{
  "type": "bundle",
  "id": "bundle--8e7b06fc-0101-4144-8708-548488f7cb84",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-11-11T00:00:00.000Z",
      "modified": "2026-11-11T00:00:00.000Z",
      "name": "Optimus Labs · Civilizations",
      "identity_class": "organization",
      "description": "Threat research team at Optimus Labs. Agentic AI attack surface research.",
      "contact_information": "https://optimuslabs.io/research/briefings"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--aceb90f8-0101-49d0-8521-556d8adeccac",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-11-11T00:00:00.000Z",
      "modified": "2026-11-11T00:00:00.000Z",
      "name": "Grok Build Shared Your App With the Internet: 35,000 Live Links, 24 From SpaceXSI Itself",
      "description": "Research by Claroc. Vibe-coded business apps went public with no clear warning and no sign-in. The share link's secret words sat in the hostname, so public DNS data listed 43,601 of them. Grok keeps giving.\n\nGrok Build is the vibe-coding agent from SpaceXSI. SpaceX and xAI merged to form SpaceXAI, which is now SpaceXSI. Claroc listed 43,601 Grok Build app addresses under grok.me, as Ars Technica reported. Of the 37,571 still online, 35,578 (94.7%) opened the app and its data with no sign-in. 24 were built by SpaceXSI and X staff, including a confidential sales onboarding plan and a 594-account territory map. Claroc estimates 650 to 800 apps held private data. The core failure is not DNS. Business apps went public without clearly telling the person who built them, and without safeguards that are secure by default. The DNS design made that exposure easy to find.",
      "published": "2026-11-11T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Posture",
        "Agent",
        "Credential",
        "severity:high"
      ],
      "object_refs": [
        "software--42bcbfec-0101-4cb4-83bd-535843beaca0",
        "software--44bcdf57-0101-4e41-85bd-b11645be4d98"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://optimuslabs.io/research/briefings/grok-build-share-link-dns-exposure"
        },
        {
          "source_name": "Ars Technica: Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI (Nov 10, 2026)",
          "url": "https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/"
        },
        {
          "source_name": "Claroc Research: GhostShares, Part 2, AI-built apps are exposing sensitive internal data again (Nov 10, 2026)",
          "url": "https://blog.claroc.io/ghostshares-grok-build-apps/"
        },
        {
          "source_name": "Claroc Research: GhostShares, Part 1, Meta Muse shares listed by passive DNS (Oct 2026)",
          "url": "https://blog.claroc.io/ghostshares-muse-passive-dns/"
        },
        {
          "source_name": "Fortune: 370,000 shared Grok chats public on Google search (Aug 22, 2025)",
          "url": "https://fortune.com/2025/08/22/xai-grok-chats-public-on-google-search-elon-musk/"
        },
        {
          "source_name": "Optimus Labs: Grok Build CLI shipped entire repos to xAI (Jul 2026)",
          "url": "https://optimuslabs.io/research/briefings/grok-build-repo-exfiltration"
        },
        {
          "source_name": "Optimus Labs: grokpatrol, offline scanner for Grok Build",
          "url": "https://optimuslabs.io/grokpatrol/"
        },
        {
          "source_name": "TechCrunch: Claude shared chats and Artifacts may have ended up on Google (Jul 27, 2026)",
          "url": "https://techcrunch.com/2026/07/27/psa-your-claude-shared-chats-and-artifacts-may-have-ended-up-on-google/"
        },
        {
          "source_name": "Malwarebytes: OpenAI removes discoverable ChatGPT shared chats (Aug 1, 2025)",
          "url": "https://www.malwarebytes.com/blog/news/2025/08/openai-kills-short-lived-experiment-where-chatgpt-chats-could-be-found-on-google"
        },
        {
          "source_name": "Axios: AI vibe-coding apps leak sensitive data (May 7, 2026)",
          "url": "https://www.axios.com/2026/05/07/loveable-replit-vibe-coding-privacy"
        }
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--42bcbfec-0101-4cb4-83bd-535843beaca0",
      "name": "Grok Build"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--44bcdf57-0101-4e41-85bd-b11645be4d98",
      "name": "xAI"
    }
  ]
}