The Grok Bot, an intelligent agent developed under SpaceX's AI division, has sparked internal apprehensions regarding data security well before its official rollout. In late July 2026, engineers from Cursor, the firm behind Grok Bot's creation, raised alarms that sensitive data pertaining to clients and suppliers—generated during internal testing and routine employee usage—might have been inadvertently sent to SpaceX's AI division. Cursor swiftly launched an internal inquiry, though the results remain undisclosed to the public.

Grok Bot, initially dubbed "Sand," has been in use by Cursor staff across diverse scenarios since approximately June 2026. During this period, the company has been amassing operational records from various sources to refine its model through training. However, the utilization of personal email accounts by some employees complicated the identification of pertinent data. Consequently, Cursor mandated a shift to company email accounts for all staff and resolved to exclude employee usage data from future model training endeavors.

Cursor's in-house legal team highlighted that the data in question might encompass confidential information from third parties, and the company might lack the legal right to employ it for training purposes. Moreover, Cursor faced a client information breach earlier this summer. Its sales and marketing website, constructed using Vercel, had passwords embedded directly in the source code, jeopardizing the client information of several companies. Upon discovery by engineers, the affected website was promptly taken offline.

Previously, SpaceX's AI division had also encountered several analogous data security mishaps. As Grok Bot emerges as a pivotal product for SpaceX in the enterprise-level AI sector, these incidents underscore the formidable challenges in security governance. These challenges encompass managing high-privilege access for intelligent agents, gathering training data, and safeguarding corporate confidential information.