Vibe coding leaks: Grok Build spills corporate secrets

Vibe coding sold one idea: say it in words, get a working app. Secure defaults were never part of the pitch. Now the bill arrives in batches.

What happened

The Elec reports: Grok Build — the vibe-coding agent from SpaceXSI, the new name of xAI after the SpaceX acquisition — leaked the accounts of thousands of users. Proprietary business information and sensitive corporate material went with them.

This is not a one-off glitch. The outlet says it plainly: AI coding platforms keep repeating the same mistake. Teams ship fast and leave the defaults wherever they land — open storage, public previews, keys sitting in the code. Companies do their part too, dumping whatever is at hand into prompts and uploads. Both sides assume security is somebody else's job.

Who builds software now

The real shift in vibe coding isn't the model. It's who sits down to build. Marketing, legal, sales, ops. People with no repo access and no habit of thinking about permissions. They get an internal tool done in an evening — and it goes online without a password, because there was nobody to ask.

Vibe coding removed the developer from the process. It also removed the one person who remembered security.

The economics of speed

Vendors compete on one thing: how fast a prompt turns into a working link. Security isn't in that race. Nobody pays for it, nobody brags about it, it doesn't show up in a demo. While one side posts "done in a minute", the other side cleans up internal documents that turned out not to be internal at all.

There's a bitter joke in the name. Grok Build promised to assemble an app from a sentence. It did. And it assembled, along with the app, things that were never meant to be an app.

Enterprise memory is long. No corporate buyer hands coding to an agent that can't keep its mouth shut, however smart it is. Competitors just got a free argument for the negotiating table, and it beats any benchmark line.

The fork ahead is simple. Either platforms close access by default and vibe coding stops being a one-evening toy. Or the next wave of leaks arrives with lawsuits attached — and generation speed saves nobody.

Prediction: Within a year, at least one major AI coding platform will make projects private by default — otherwise the next lawsuit lands before the feature does.

Disclaimer: not officially confirmed; single source, industry outlet The Elec.

The Elec