According to a media investigation, Grok Bot, an agent under SpaceX's AI division, raised internal data security concerns before its release. In the second half of the 7th month of 2026, engineers at Cursor, which developed the product, warned that data generated from internal testing and employees' daily use might contain confidential information about customers, suppliers and business partners, and may have already been transmitted to SpaceX's AI division. Cursor subsequently launched an internal investigation, but the findings have not yet been made public.
Grok Bot was originally codenamed Sand, and Cursor employees began using it around the 6th month of this year, covering scenarios such as sales, recruiting and research. To improve the product, Cursor collected operation records from employees, external individuals and enterprise users to train the model to learn how the agent executes tasks. Because some employees logged in with personal email addresses, the company had difficulty accurately identifying the relevant data. In response, Cursor required employees to switch to company email addresses and decided that future model training would no longer include employee usage data. Cursor's lawyers previously noted in internal communications that the relevant data might contain confidential information about customers and partners, and the company might not necessarily have the legal authority to use it for model training.
In addition, Cursor also suffered a customer information leak this summer. The company's sales and marketing website built on Vercel wrote passwords directly into the underlying code, exposing some customer information of companies such as Verizon, Bosch and Coupa to risk; after engineers discovered this, the relevant website was urgently taken offline.
SpaceX's AI division had previously encountered similar problems. In March 2025, an employee mistakenly uploaded a test script to a public GitHub repository, leaking Grok API keys; this summer, Grok Build was found to have possibly uploaded complete Git code repositories to SpaceX's Google Cloud storage, after which the upload feature was shut down. As Grok Bot becomes a key product in SpaceX's AI division's contest for the enterprise AI market, these incidents highlight the security governance challenges surrounding agents' high-privilege access, training data collection and the protection of corporate secrets.