Security firm Claroc has now quantified the Grok Build exposure: of 43,551 app addresses tested under SpaceXSI's grok.me domain, 37,571 were still online, and 35,578 of those, 94.7%, opened to anyone on the public internet without a sign-in10. Twenty-four of the open apps were built by SpaceXSI and X staff, holding a confidential onboarding plan, a sales territory map of 594 accounts, and advertising proposals. Claroc also identified sensitive data belonging to 30 other organizations, 26 with more than 1,000 employees and six in the Fortune 500. The Grok Build findings, the Claude Code settings-file leak, and Railway's $740,000 breach together show three independent platforms, three different failure modes, and three different security firms documenting credential and data exposure at industrial scale.
ANALYSIS The thesis is specific: the agent layer, the software that sits between a foundation model and a user's live environment, has become the weakest link in the credential chain. The evidence spans an Anthropic product, a SpaceXSI product, and a cloud hosting provider. The root causes differ (settings-file hygiene, URL enumeration, build-system escape) but the failures converge because the agent layer, by design, concentrates secrets in new locations (local config files, shareable app containers, build caches) that existing security tooling does not adequately cover.
The most granular numbers come from the Claude Code exposure. Security firm Apiiro found 1,379 secrets in 1,122 of 104,185 public copies of Claude Code's .claude/settings.local.json file on GitHub2,6. GitGuardian, scanning public commits from January 2025 through November 7, 2026, reported a far larger figure: 31,088 distinct secrets in Claude Code settings files, of which 5,343 passed its automated validity checks when detected. The discrepancy reflects different methodologies and time windows rather than contradiction; Apiiro did not test whether credentials still worked, while GitGuardian monitored commits over a longer period. Apiiro's broader total was 2,539 secrets across 1,994 repositories, including Git history, shared settings, transcripts, memory and handoff files, and VS Code Copilot auto-approve settings. Both firms agree on the mechanism: when a user approves a shell command with Claude Code's "Yes, and don't ask again" option, the command, including any embedded password or API token, is written verbatim into a local settings file. Anthropic's documentation adds that file to the developer's global .gitignore list, which ordinarily prevents it from being committed to a repository. Despite that safeguard, the scale of the exposure documented by both Apiiro and GitGuardian demonstrates that thousands of developers committed the file anyway, sending secrets to public repositories.
Vector Wire covered the initial Apiiro findings on November 10[2]. The jump from Apiiro's 1,379 secrets to GitGuardian's 31,088 underscores that a single .gitignore directive is plainly insufficient when the user population is large enough and the default behavior writes secrets in cleartext. What distinguishes the Claude Code case is the mechanism: the agent's convenience feature programmatically writes credentials into a config file as a side effect of a permission grant, shifting the failure from individual hygiene to system design.
Grok Build presents a different failure mode but the same outcome. Claroc's research, published on November 10, shows that Grok Build exposes user data through shareable app links1,9. Grok randomizes those URLs, but a design decision makes it possible for anyone to enumerate thousands of live projects. The enumeration vector is passive DNS: Grok Build's hostname-based sharing means each app gets its own web address under grok.me, and DNS records expose them. By default, Grok sets links to "Anyone with the link". Users can change the setting to "invited users" or "only you," but nearly 95% had not done so.
Permissive link defaults are not unique to AI agents. What makes Grok Build's case agent-specific is what the links expose: a shared Grok Build link leaks the entire application context, including source code, embedded data, and any credentials the agent ingested during the build. The agent's role as an intermediary that absorbs business logic, user data, and secrets into a single deployable artifact turns a generic SaaS sharing-defaults problem into a credential-exposure problem at a different order of magnitude.
The exposed material is not trivial. Claroc found internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers. SpaceXSI itself was a victim of its own platform: the 24 SpaceXSI-built apps included a confidential onboarding plan for a new enterprise sales team member, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals. "We were shocked," Claroc said. SpaceXSI says its employees' apps start out private, but its own staff still had 24 apps open to anyone. SpaceXSI took those apps down after Claroc's report but has not done the same for apps other Grok users and organizations left open. Other app builders, including Lovable, Bolt, and Replit, give each app its own web address, meaning the same DNS enumeration technique could expose them too.
The Railway breach adds a third dimension. Railway's November 10 incident report describes an attack that began at 07:28 UTC on October 20, when hackers exploited a previously unknown flaw in Railway's build infrastructure to escape filesystem isolation and obtain an internal credential5,7,8. That credential carried more trust than intended, granting access to stored build histories from 353 builds, including secrets. Attackers then accessed cached repository snapshots containing Railway's internal source code, giving AI agents a map to search for weaknesses and test several routes at once. Railway confirmed that the attackers could have obtained decrypted environment variables for at most 1.85% of its workspaces, approximately 100,000. The company estimated unauthorized spending on stolen keys at approximately $740,0004.
What makes the Railway case distinctive is the attacker's tooling. Railway described the incident as a contest of agent speed, with Railway defending against abliterated models and a harness similar to ARTEX, according to Wiz. The roughly 26-hour battle ran from the initial exploit at 07:28 UTC on October 20 through 09:24 UTC on October 21, when the attacker was fully evicted. Railway's investigation found that the attackers specifically searched for AI provider credentials, suggesting the stolen keys were targeted for resale. The breach exposed linked-account tokens belonging to 1,852 users, including GitHub OAuth tokens and AI agent keys.
Railway's breach was an infrastructure escape, not a flaw in an AI coding agent's own secret handling. The attackers used AI agents as offensive tools, not as the leaking surface. The case matters here not because it fits the same failure mode as Claude Code or Grok Build but because it demonstrates the demand side: Railway's report states that attackers specifically searched for AI provider credentials, and the $740,000 in estimated unauthorized charges prices what happens when stolen keys reach adversarial hands. Claude Code and Grok Build illustrate how credentials leak passively through design oversights; Railway shows adversaries building AI-powered tooling to harvest that inventory.
Each failure is individually fixable. Anthropic's .gitignore directive is a reasonable first defense that users overrode. Grok Build's default link setting can be changed to "invited users" or "only you". Railway says all exploited vulnerabilities have been remediated. But the pattern across platforms argues that the problem is structural. AI coding agents, by design, need access to credentials, environment variables, and internal systems to do their work. Every agent that touches a secret creates a new exfiltration surface. The current generation of agents treats secret handling as an afterthought, writing credentials in cleartext, bundling them into shareable artifacts, caching them in build systems, rather than as a core design constraint. The agent platforms raising billions in capital are shipping defaults that treat credential isolation as someone else's problem. Anthropic is pursuing a $100 billion IPO. Claude Code was running at a $2.5 billion annual run rate as of February. SpaceX raised $40 billion in debt in October.
What to watch: whether Anthropic changes Claude Code's default behavior to hash or redact commands before writing them to settings files. Whether SpaceXSI changes Grok Build's default link setting from "Anyone with the link" to a more restrictive option for all users, not just its own staff. Whether the passive DNS enumeration technique Claroc used against grok.me is replicated against Lovable, Bolt, or Replit, which use the same hostname-per-app pattern. The $740,000 Railway figure represents estimated unauthorized spend on stolen keys; whether that proves to be an outlier or a baseline will become clearer as more breaches of this class surface.