Cursor Staff Investigated Whether Confidential Data Reached SpaceX for AI Training

In the weeks before SpaceX’s AI unit in August introduced Grok Bot, its version of a personal AI agent, engineers at Cursor discovered a potential problem.

Cursor, the AI coding startup SpaceX was then in the process of acquiring, was developing Grok Bot, and as part of that process, employees across Cursor were using the tool extensively for testing and as a part of their everyday work. In late July, engineers raised concerns that Cursor might have sent data from that internal testing—potentially including confidential information about its customers, suppliers and business partners—to SpaceX’s AI unit. One of Cursor’s lawyers warned that if word got out that the company was using the data for training, that could cause a “huge trust problem,” according to internal communications viewed by The Information.

Cursor began an investigation to understand what, if any, sensitive data employees had sent to SpaceX’s AI unit, now known as SpaceXSI, according to internal communications viewed by The Information and two people familiar with the project. While the outcome of Cursor’s internal investigation couldn’t be learned, the company took steps to ensure that in the future, training models would not include employee usage data.

The episode spotlights a challenge AI developers face, especially amid the rising popularity of agent tools like Grok Bot. By design, those agents are supposed to have wide latitude to roam across files and applications on a user’s computer so they can accomplish tasks autonomously.

But that freedom introduces new security risks, including the possibility of unintentionally sharing sensitive information with models for training purposes. In general, AI companies have said they will not train off access to connected tools like Gmail and Google Drive. In Grok Bot’s terms and conditions, for example, SpaceXSI says the company does not use Google Drive for model training and that users can opt out of sharing their data for that purpose.

The Grok Bot investigation isn’t the only time Cursor has faced issues with data security. During the summer, its employees inadvertently exposed some customer information through publicly accessible websites built for internal use, according to internal communications viewed by The Information.

SpaceXSI didn’t respond to a request for comment.

Even before SpaceX completed its $60 billion acquisition of Cursor in mid-August, Cursor was working to expand its offerings beyond coding-focused tools. Since then, Grok Bot, an always-on AI co-worker that can handle a broad range of tasks, has become a key part of SpaceXSI’s effort to nab a bigger piece of the lucrative enterprise market for AI tools.

To improve early versions of Grok Bot, Cursor tested the product with both Cursor and SpaceXSI employees, as well as people and companies outside Cursor, according to the two people familiar with the project. The startup collected records of how people used the agent. Cursor could then use that data to train AI models by showing them how an agent carries out a task, including the actions it takes and the information it accesses while performing the task.

Inside Cursor, employees first got their hands on Grok Bot—then code-named Sand—around June. The product quickly became a hit around the office, Roman Ugarte, Cursor’s former head of growth, said in a podcast interview. He said employees used Grok Bot for sales, recruiting, research and other tasks, often giving the software access to company systems and asking it to carry out work independently. That meant they might use the agent in work involving external customers and with prospective hires, potentially exposing it to sensitive information from sales conversations, customer records and recruiting conversations, one of the people said.

But in July, shortly before Cursor released Grok Bot publicly, some of its engineers used a Slack incident channel to flag their concern that there could be confidential information in the training data the company had been collecting from internal usage of Sand, and that it might have sent that information to SpaceXSI.

As part of its investigation, Cursor reviewed which users were included in the training data it sent, according to internal communications and people familiar with the issue. Some Cursor employees had been using Sand with their personal email addresses, which made it harder for the company to identify them and exclude their data from the training process in the future, one person said.

As a result, Cursor made it so employees could no longer access Sand without using their Cursor email addresses. It also moved to exclude any data coming from Cursor employees in future training.

“From a legal standpoint because of the broad general purpose use of Sand, the datasets involved are going to include confidential information that belongs to customers, partners, vendors etc.,” the Cursor lawyer wrote in a company Slack channel. “Legally, we arguably don’t have the rights to train on this data.”

This isn’t the first time Cursor has had to deal with the aftermath of potentially sloppy handling of user data.

Earlier this year, in a previously unreported incident, Cursor sales and marketing staff inadvertently exposed customer information to the internet, according to internal communications viewed by The Information. The issue involved websites the staff had built using Vercel, a platform for creating websites and apps. The sites helped the Cursor sales and marketing team manage its relationships with current and prospective customers.

One of those websites allowed Cursor to manage its customer relationship with Verizon: It included an organizational chart of some Verizon technology leaders, and listed a handful of Verizon’s top users of Cursor’s tools, along with how much they were spending on the product and the email addresses for each user, documents show.

While the Verizon website was password protected, that password and all of the Cursor customer information was embedded in the underlying code, according to Cursor’s internal communications. That meant anyone on the public internet looking at the code could have seen the password and information.

The company faced similar issues with other companies’ data, including those of Bosch and Coupa, internal communications show. Upon discovering the issues, Cursor engineers scrambled to take down the websites. They even gave a lengthy name to a Slack channel in which they communicated about the growing number of issues: “A ton of gtm sites that leak customer/internal data” (GTM stands for go to market).

Bosch referred questions to Cursor, while Coupa declined to comment. Verizon didn’t respond to a request for comment. Vercel declined to comment.

Well before Cursor became a part of SpaceXSI, the rocket company’s AI unit faced similar problems. In an incident in March 2025, a SpaceXSI employee exposed a Grok application programming interface key, which gave access to unreleased xAI models, after they accidentally sent a test script to a public GitHub repository.

And this summer, a researcher discovered that SpaceX’s Grok Build developer tool uploaded entire Git repositories to company-owned Google Cloud storage, potentially exposing proprietary source code or credentials developers had not intended to share. In response, xAI disabled repository uploads and made the tool open source. Elon Musk wrote on X, “All user data that was uploaded to SpaceXAI before now will be completely and utterly deleted.”