Grok Build apps exposed: Claroc says 35,578 grok.me apps open to anyone, incl. SpaceXSI's own

Grok Build, the AI app builder from SpaceXSI (the merged SpaceX and xAI), publishes every shared app at its own hostname under grok.me, and that choice has left tens of thousands of apps readable by anyone who looks. The security firm Claroc reports that 35,578 of 37,571 live Grok Build apps it tested opened without any sign-in, among them 24 apps built by SpaceXSI and X staff that held internal sales material. SpaceXSI took those 24 down within hours of a reporter's questions, but Claroc says the apps of other users and organizations were still open when it published on 10 November 2026.

Key points

• Claroc says it found 43,601 app names under grok.me, tried 43,551 addresses, found 37,571 online and opened 35,578 of them (94.7%) with no sign-in; 1,993 (5.3%) answered with HTTP 401.
• The app names leak because the random words sit to the left of the domain (cinder-crane-sand-frost.grok.me), so passive DNS databases record them; Google, Claude, ChatGPT and Gemini shared links put the secret in the path instead.
• Claroc estimates about one in ten open apps held sensitive, internal business or personal data, and that roughly 650 to 800 apps in total held private data.
• Claroc says it reported the problem to SpaceXSI on 8 November and the other 22 SpaceXSI and X staff apps on 9 November; the 24 staff apps were taken down on 10 November.
• SpaceXSI says apps are private until the creator shares them. Claroc says the publish panel preselected "Anyone with the link".

What to do

• If you build with Grok Build: open each published app's sharing setting and change "Anyone with the link" to "Invited users" or "Only you" unless the app is meant to be public. Claroc says unpublishing took an address offline within seconds.
• If you run security or IT for a company: find out which AI app builders your staff use, search passive DNS for those builders' domains, open the results in a private browser window, and unpublish apps nobody owns. Claroc recommends this check for every builder, not only Grok.
• Check what the apps hold: apps that have a database but no sign-in are the highest risk. Claroc says an anonymous visitor could add rows to one of its two test apps. Rotate any password or key that was stored in an app's pages or scripts.
• If you are an affected organization: Claroc says it began notifying companies directly on 10 November and had emailed three by publication.

What happened

Claroc found the apps with ordinary subdomain discovery, which it says turned up 43,601 names under grok.me. It tried 43,551 addresses and 37,571 were still online. It loaded each app's first page once from the public internet, signed in to nothing, and read saved copies offline. An AI model flagged pages that looked private, and the researchers checked the flagged apps by hand. They say they did not sign in, submit forms, call server functions or use any password they saw; writes and deletes happened only on two test apps they built themselves.

The result: 35,578 apps, or 94.7%, opened for anyone. The remaining 1,993 returned HTTP 401. Claroc says about one in ten of the open apps held sensitive, internal business or personal data, and about 2% held material it rated high or critical. A random-sample check led it to estimate 650 to 800 apps with private data in total. It identified 30 organizations beyond SpaceXSI: 26 with more than 1,000 employees, six of them in the Fortune 500, 18 in the US and 12 in 11 other countries.

The exposed material, as Claroc describes it, included sales pipelines and territory maps, an advertising proposal marked confidential for a US federal agency, a hospital staff roster of more than 3,500 employees, an ICU patient briefing with lab values and ventilator status, cruise ship crew names and IDs, firefighter names and badge numbers, a trucking recruiting list of more than 1,000 people, and a contractor timesheet with 18 accounts' passwords in plain text. Ars Technica, which reported the research on 10 November, adds internal business plans, advertising proposals and medical exam results to the list.

SpaceXSI's own 24 apps were the most awkward finding. Ars Technica says they included an onboarding plan marked confidential for a new enterprise sales hire, a sales territory map covering 594 accounts, addresses of internal sales tools and advertising proposals. Claroc reported two of them on Sunday 8 November and the other 22 on Monday; Ars says that when nobody replied, a Claroc official tagged Elon Musk and Grok's manager on X. All 24 were still exposing data on Monday evening. SpaceXSI began removing the links within a few hours of Ars emailing questions, and Ars says all 24 returned "app not found" by the time it published.

Background

The flaw rests on a design pattern called capability-based access control: anyone who holds a long, unguessable URL is treated as authorized. Google Docs works this way, with a long random string in the path after the domain. Ars explains that a phrase of three random "dice words" carries roughly 38 bits of entropy, billions of combinations, so guessing a link is impractical.

Guessing is not what happened here. When a service gives each app its own hostname, every first visit makes a DNS server look the name up, and passive DNS services record those lookups in publicly searchable databases. A secret placed in the hostname therefore becomes a searchable list. Ars says a passive DNS search returned 43,601 links ending in grok.me, which matches the number of names Claroc reports.

Claroc says Grok is not alone in using hostnames: Lovable, Replit, Base44, Google AI Studio, Meta's Muse, v0 and Bolt do too, and ChatGPT's published apps use <app-name>.<username>.chatgpt.site, which still reaches passive DNS. The difference, it says, is what ended up behind the addresses: "Grok is where we found by far the most sensitive company data," Claroc's CTO Asaf Aprozper told Ars. Shared chats from Claude, ChatGPT and Gemini keep their secret in the URL path, so DNS never sees it. Ars notes that Meta's Muse agent recently suspended a link-sharing feature after it also leaked data.

Link-sharing mistakes by AI products are not new. Claroc points to August 2025, when more than 370,000 shared Grok conversations appeared in Google search.

The numbers

Addresses found43601

Still online37571

Opened with no sign-in35578

Required sign-in (HTTP 401)1993

Grok Build apps under grok.me, Claroc's count (apps)

	apps
Addresses found	43601
Still online	37571
Opened with no sign-in	35578
Required sign-in (HTTP 401)	1993

Source: Claroc research post on Grok Build apps

The ratio matters more than the total. Almost 19 in 20 live apps were public, which fits Claroc's argument that the preselected default, not a handful of careless users, drove the exposure. Claroc's own test is telling: with the setting "Only you", a stranger got a 401 and unpublishing took an address offline within seconds.

What it means

For Grok Build users. Treat any app you published as public until you have checked its setting. SpaceXSI says publishing takes several steps (Publish, choose an address, Publish again, choose access, accept a disclaimer, Publish again) and that employee accounts default to "Only you". Claroc replies that extra clicks do not protect data when the access step offers "Anyone with the link" preselected, and notes that "Only you" alone would not have protected the 24 staff apps. Ars quotes a representative for Cursor, which SpaceXSI recently acquired, saying apps are private by default and nothing goes public unless the creator chooses to share it. Claroc's tests, as Ars reports them, contradict that: in every case Grok Build required users to change "Anyone with the link" to one of the other two options.

For security teams. The finding is a reminder that AI-built apps are internal tools published as websites. Claroc's example is blunt: a sales team that bought a tool would have had it behind company sign-in, but an app built with AI went live open to anyone with the link. Shadow deployment of internal tools is now a data-loss channel.

For platform builders. Claroc proposes four fixes: serve shared apps on hard-to-guess paths under one host so links never become DNS names; add an "everyone in my organization" option limited to the company's email domain; make "Only you" the default and show who can open an app before it goes live; and warn at publish time when an app has a database but no sign-in. A reader quoted by Ars raised a trade-off: a single shared host puts all apps on one origin, so an app running arbitrary JavaScript could read another's data unless the platform separates them some other way. That is an argument for care in the fix, not for leaving things as they are.

A second flaw, in the test apps. Claroc built two test apps. The first had no sign-in, and an anonymous visitor could add rows. In the second, which used Google or X sign-in, it says the generated code added each signed-in user to the team before checking membership, so the check always passed and an outside Google account could read, edit and delete records. That is a code-generation bug rather than a hosting one, and it would matter even with a perfect sharing default.

What we don't know yet

• Whether SpaceXSI will change the default or move apps to path-based links. Ars says the company did not answer follow-up questions, including whether it intended to expose the internal material and whether it will notify customers.
• How many of the 35,578 open apps were meant to be public. Claroc's sensitivity figures are its own estimates from a sample, not a count of confirmed leaks.
• Whether anyone other than the researchers read the data. Neither Claroc nor Ars reports evidence of misuse.
• The exact number of affected organizations. Claroc named 30 beyond SpaceXSI; it is still notifying them.
• Some outlets give different totals; this article uses Claroc's post, which Ars's figures match (43,601 links, more than 35,000 public, nearly 95%). We could open only Claroc's post and Ars Technica; other coverage repeats them.

What to watch next

Watch whether SpaceXSI changes the publish default or the hostname scheme, and whether the other builders Claroc names respond. Claroc's advice to organizations includes searching passive DNS for AI app builder domains as a routine check. For related background on tightening what your coding agent can reach, see our guide to auditing the plugins, hooks and MCP servers your AI coding agent loads.

Sources

• Claroc, research post on exposed Grok Build apps (primary, 10 November 2026)
• Ars Technica, Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI (10 November 2026)