Abstract:
A few weeks before the SpaceX artificial intelligence department launched Grok Bot, a personal AI agent product, in August, engineers at Cursor discovered a potential vulnerability. At that time, SpaceX was acquiring Cursor, an AI code startup, and Grok Bot was developed by Cursor. During the development process, all Cursor employees used this tool extensively for testing and daily work.
In late July, engineers raised concerns that Cursor may have sent data generated by internal testing, which may contain confidential information of customers, suppliers and business partners, to SpaceX's artificial intelligence department. According to internal communications reviewed by the media, a Cursor lawyer warned that once outsiders learn that the company uses the data for model training, it may trigger a "serious crisis of trust."
Cursor immediately launched an internal investigation to find out what sensitive data, if any, was sent to SpaceX's artificial intelligence unit, now known as SpaceX SI, according to internal documents reviewed by the media and two people familiar with the project. The conclusion of this internal investigation is unclear, but the company has taken steps to ensure that subsequent model training no longer incorporates data generated by employee use.
The incident highlights a challenge faced by AI research and development companies, which has become increasingly prominent as agent tools such as Grok Bot become more popular. This type of agent is designed to be given higher permissions and can traverse various files and applications on the user's computer to complete tasks autonomously.
But this high degree of freedom brings new security risks, including inadvertently providing sensitive information to the model for training. In general, major AI companies have stated that they will not use data obtained from Internet tools such as Gmail and Google Cloud Disk to conduct model training. For example, in Grok Bot's terms of service, SpaceX SI states that the company will not use Google Cloud Disk data to train models, and users can choose to refuse to share their own data for this purpose.
The Grok Bot-related data investigation is not the only data security incident Cursor has encountered. Internal communications reviewed by the media showed that this summer, company employees accidentally leaked some customer information through a publicly accessible website built for internal use.
SpaceX SI did not respond to a request for comment.
Even before SpaceX completed its $60 billion acquisition of Cursor in mid-August, Cursor was expanding its business and was no longer limited to coding tools. After the acquisition is completed, Grok Bot, an all-weather AI collaboration assistant that can handle various tasks, has become SpaceX SI’s core product in competing for the lucrative enterprise-level AI tool market.
Two people familiar with the matter revealed that in order to optimize the early version of Grok Bot, Cursor arranged for the company, SpaceX SI employees, and external individuals and companies to test the product, while collecting user behavior records of using the agent. Cursor can use this data to train the AI model, allowing the model to learn how the agent performs tasks, including the operations performed and the information retrieved during the task.
Romain Ugarte, the former head of growth at Cursor, mentioned in a podcast interview that around June, Cursor’s internal employees were the first to use Grok Bot, then codenamed Sand. The product quickly became popular within the company, with employees using it to handle sales, recruitment, research and other tasks. They often authorized the software to access the company's systems, allowing them to work independently. People familiar with the matter said that this means that employees will use the agent in scenarios where they are interacting with external customers and interviewing potential candidates, potentially exposing it to sensitive information in sales conversations, customer files, and recruitment communications.
But in July, shortly before Cursor released Grok Bot, some engineers warned on the Slack incident reporting channel: the training data collected by the company from Sand's internal usage scenarios may contain confidential information, and this batch of data may have been transferred to SpaceX SI.
As part of its investigation, Cursor reviewed the range of users included in the training data set, based on internal communications and people familiar with the matter. A person familiar with the matter said that some Cursor employees used personal emails to log in to Sand, which made it difficult for the company to identify such users and eliminate their data from subsequent training.
To this end, Cursor has made restrictions: employees must use company email to log in to Sand, and has decided not to include any data generated by Cursor employees in future training.
Cursor's lawyer wrote on the company's Slack channel: "From a legal perspective, Sand is a general tool, and its data set contains confidential information about customers, partners, suppliers, etc. Strictly speaking, we do not have the legal authority to use this data for model training."
This isn’t the first time Cursor has had to clean up the mess for mishandling user data.
Internal communications reviewed by the media showed that a previously unreported incident occurred earlier this year: Cursor sales and marketing personnel accidentally exposed customer information on the Internet. The problem lay in the websites the team built based on the website development platform Vercel, which were used by the sales and marketing teams to maintain relationships with existing customers and potential customers.
The documents show that one of the websites is used to manage customer docking with Verizon. The website contains an organizational chart of part of Verizon's technical management, listing several core users of Verizon's internal Cursor tool, product consumption amounts, and each user's email address.
Cursor's internal communication records show that although the Verizon-related website has a password, the password, along with all customer information, was written directly into the underlying code. Any Internet user viewing the code can obtain the password and customer information.
Internal communications also show that the company has encountered similar problems with data from other companies such as Bosch and Coupa. After discovering the vulnerability, Cursor engineers urgently took the relevant website offline. They even gave the Slack channel dedicated to discussing this endless problem a long name: "A large number of GTM websites leaked customer/internal data" (GTM stands for Go to Market).
Bosch referred inquiries to Cursor, Coupa declined to comment, Verizon did not respond to interview requests, and Vercel declined to comment.
Long before Cursor was merged into SpaceX SI, the aerospace company's AI department had encountered similar data security incidents. In March 2025, a SpaceX SI employee mistakenly uploaded a test script to the public GitHub code repository, leaking the Grok application program interface key. Outsiders can use the key to access the xAI model that has not been released to the public.
This summer, a researcher discovered that SpaceX’s developer tool Grok Build would upload the complete Git code repository to SpaceX’s Google Cloud Storage, potentially leaking proprietary source code or identity credentials that developers had no intention of making public. In response, xAI closed the warehouse upload function and made the tool open source. Elon Musk posted on the X platform: "All user data previously uploaded to SpaceX AI will be completely and completely deleted."
Comments