Cursor urgently investigates the flow of confidential internal test data to SpaceX. Under the wave of rapid development of large artificial intelligence models and agents, the boundaries of data security and privacy within enterprises have once again attracted great attention.

Cursor urgently investigates the flow of confidential internal test data to SpaceX. Under the wave of rapid development of large artificial intelligence models and agents, the boundaries of data security and privacy within enterprises have once again attracted great attention. Recently, Cursor, which is responsible for the development, encountered a data security crisis internally. The reason was that confidential information generated during its internal testing and employees' daily use may have flowed into SpaceX's AI department. The focus of the incident points to the intelligent agent Grok Bot (originally codenamed Sand) under the SpaceXAI department. As early as around June 2026, Cursor employees began to use this tool in multiple work scenarios, and the company had collected operation records from multiple parties for model training. However, because some employees use personal emails when logging in, it is difficult for the system to accurately identify and strip away relevant data. By late July 2026, the engineers responsible for development warned the company that these test and daily use data may contain highly confidential information from customers, suppliers, etc., and have been transferred to the SpaceXAI department. Faced with potential compliance and security risks, Cursor immediately launched an internal investigation, but the specific investigation conclusions have not yet been made public. In order to prevent similar problems from expanding further, Cursor subsequently adopted a series of corrective measures to remedy the situation. The company not only requires employees to use company email to log in, but also makes it clear that employees’ subsequent usage data will no longer be included in model training. Its internal legal team also made it clear that the relevant data may contain third-party trade secrets, and the company itself may not have the legal authority to use it directly for model training. It is worth noting that data security risks are not the only recent disturbance. This follows another customer information breach at Cursor this summer. At that time, the sales market website it built through Vercel had the password written directly in the underlying code, which caused some customer information of many companies to be exposed. Fortunately, engineers found out in time and took the relevant website offline as a matter of urgency. As Grok Bot gradually becomes an important core product for SpaceX to compete for the enterprise-level AI market, this series of incidents not only exposed the management vulnerabilities of cutting-edge tools during the internal testing phase, but also highlighted the intricate security governance challenges between high-privilege access to agents, collection of training data, and protection of corporate secrets. via AI News (author: AI Base)