Grok Build apps left open to anyone, including SpaceXSI's own

Grok Build is a vibe-coding agent from SpaceXSI, the name of the now-merged SpaceX and xAI. Vibe coding means you describe what you want in everyday words, and the AI writes the software for you. You can have a working app in minutes.

When you publish one, it gets its own address under the grok.me domain. Anyone with that address can open the app, as long as the sharing setting allows it. Most of these apps are games, landing pages and calculators.

But people also use tools like this for work. A sales lead builds a quick team tracker. A hospital manager builds a staff board. Nobody asks IT first, because it takes ten minutes.

Claroc listed 43,601 app addresses under grok.me. Of the 37,571 still online, 35,578 opened for anyone with no sign-in. That is 94.7 percent. Only 1,993 returned an access-denied error.

Claroc estimated that about one in 10 open apps held sensitive business or personal data. It put the number of apps with private data at roughly 650 to 800.

• Addresses found: 43,601 under grok.me.
• Still online: 37,571.
• Open to anyone: 35,578, or 94.7%.
• Likely holding private data: about 650 to 800.

Most of the exposed apps were harmless, but the few that were not held real people's names, health details and company secrets.

Claroc confirmed a number of cases by hand. A hospital group's roster listed more than 3,500 employees. An intensive care briefing for one patient showed lab results and ventilator status. A fire department's live shift board listed badge numbers.

One contractor's timesheet app had code that held 18 employee accounts with passwords in plain text. Claroc also identified 30 organizations with internal data in open apps. Of those, 26 had more than 1,000 employees and six were in the Fortune 500. Claroc did not name them.

A longer list of examples was shared with reporters:

• Tesla: a service-center scorecard naming 22 technicians, with productivity and bonus status.
• A Peruvian construction company: a health dashboard with 3,784 worker medical exams.
• A US Navy ship engineering contractor: a roster of 108 people on a logistics support contract.
• A Norwegian-Finnish aerospace and defense group: a load board for an explosives building at a US plant.
• An auto transport company: a quote desk with about 4,000 vehicle-transport orders, prices and margins.
• A US home construction company: a call sheet with about 583 home-buyer prospects, budgets and financing notes.

SpaceXSI's own. Claroc found 24 open apps built by SpaceXSI and X staff. They included an onboarding plan, marked confidential, for a new member of the enterprise sales team. It listed internal system addresses, the team's tools and 19 internal chat channels.

There was also a map of 594 strategic sales accounts and their pipeline. Other apps held eight X advertising proposals and media plans, one to a US federal agency and marked confidential. Four live advertiser boards showed campaign spend, and there were campaign reports for advertisers in Brazil, Japan, Korea and Thailand.

"We were shocked," wrote Asaf Aprozper, Claroc's co-founder and chief technology officer. "The company that makes Grok had its own internal material open to anyone holding the link."

In real life Imagine a team builds a quick tracker for sales accounts, then shares it by link in chat. The link is long and random, so it feels private. In fact, it was in a public list from the first time anyone opened it.

Here is the technical heart of it. Grok gives each app an address like four random words followed by grok.me. The random words are meant to make the address hard to guess. This idea is called capability-based access: whoever holds the link is allowed in.

Google Docs uses the same idea, but it puts the random code after the domain, in the path. Grok put it before, in the hostname.

That matters because of DNS, the internet's phone book. Every time someone opens an address, a DNS lookup turns the name into a machine address. Passive DNS services collect these lookups into databases that anyone with an account can search by pattern. A name in the hostname lands in that database. A path never does.

• Grok Build: the random part is in the hostname, so passive DNS records it.
• Claude's published artifacts, ChatGPT's shared conversations and Gemini's shares: the random part is in the path, so DNS never sees it.

The catch: Claroc says Lovable, Replit, Bolt and other app builders also give each app its own hostname, so the same records can expose them. It reports that Grok is where it found by far the most sensitive company data.

This is where the two sides differ. In Claroc's paid account, the publish panel offered "Anyone with the link", "Invited users" and "Only you", with the first already selected. Aprozper said tests over the past week showed that Grok sets links to "Anyone with the link" by default.

A representative of Cursor, the AI coding company SpaceXSI recently acquired, said Grok Build apps "are private by default and nothing goes public unless the creator chooses to share it." The representative also said competing coding agents from ChatGPT, Lovable and Bolt let users make shareable links too. SpaceXSI also told a reporter that publishing takes several clicks and a legal disclaimer, and that employee accounts default to "Only you".

Claroc says its tests contradict the claim: in each case, users had to change "Anyone with the link" to one of the other two options. The representative did not answer follow-up questions, including why the company removed its own apps.

Claroc reported the problem to SpaceXSI through the address in the company's security.txt file on Nov. 8. It sent details of the other 22 staff apps on Nov. 9. When nobody replied, a Claroc official tagged Elon Musk and a Grok manager on X.

All 24 SpaceXSI apps were still exposed on Monday evening. SpaceXSI began removing the links within a few hours of reporters emailing questions. By Tuesday, they returned an "app not found" error.

The apps of other users were still open at publication. Claroc says SpaceXSI had not said it would contact those owners, so it began notifying them itself. It had emailed three by publication. Aprozper said the luxury cruise company's security chief pulled in the whole security team right away and began working to contain the exposure.

Claroc also asked SpaceXSI to make four changes:

• One host: serve apps under a path on a single host.
• Team sharing: add an organization-only option.
• Safer default: make "Only you" the default setting.
• A warning: warn when an app has a database but no sign-in.

No. In July 2026, a researcher named Cereblab found that the Grok Build command-line tool packaged users' whole code repositories, including Git history and committed secrets, and uploaded them to company cloud storage. Elon Musk said all stored data would be deleted.

SpaceX then published the tool's code as open source in a single commit, around 844,000 lines of Rust. It said it had turned off data retention by default from July 12 and invited researchers to report problems through a bug bounty program paying $100 to $20,000. That earlier case was about a tool on developers' computers. This one is about apps that people publish to the web.

Claroc also tested its own app. In a team app where Grok added Google and X sign-in, the code added whoever signed in to the team before checking membership. An uninvited Google account could read, edit and delete records. Claroc says it ran write tests only on its own apps.

• If you build apps with an AI tool: open the sharing settings and pick "Only you" or "Invited users" unless the app is meant for the public.
• Never put secrets in a quick app: passwords, patient data and staff IDs do not belong in something built in ten minutes.
• If you work for a company: ask what AI-built tools your team has published. IT may not know they exist.
• If your data may be in one: ask your employer. Claroc is notifying organizations it identified.