Security researchers say more than 35,000 Grok Build apps could be opened by anyone, with no sign-in, and some held confidential business plans and private personal data. The most awkward detail is that 24 of the open apps were built by staff at SpaceXSI, the merged SpaceX and xAI company that makes Grok. If you have published anything from Grok’s app builder, this is a good moment to check who can see it.
What Researchers Found in Grok Build Apps
Security firm Claroc published the findings on November 10 in a report it calls GhostShares 2. Its team listed 43,601 app addresses on Grok’s grok.me domain and tried 43,551 of them. Of the 37,571 apps still online, 35,578, or 94.7%, opened for a total stranger.
Most of those apps were harmless, like games, landing pages and calculators. Claroc says about 1 in 10 held sensitive business or personal data, and it estimates roughly 650 to 800 apps contained private information. About 2% held material it rated as high or critical.
SpaceXSI’s own apps were exposed
Among the open apps were 24 built by SpaceXSI and X staff. They included a confidential onboarding plan for a new enterprise sales hire, a sales territory map covering 594 accounts, and several X advertising proposals and campaign reports. One proposal, marked confidential, was addressed to a US federal agency.
SpaceXSI took those 24 apps down after Claroc’s report and press questions. According to the researchers, the apps that other Grok users left open were not taken down.
Other organizations caught up
Claroc says it could identify 30 other organizations with internal data in open apps, including six Fortune 500 companies. It did not name them. The kinds of material it confirmed by hand include:
- A hospital group’s staff app with a roster of more than 3,500 employees
- An intensive care briefing for one patient, with labs and ventilator status
- A fire department’s live shift board with names and badge numbers
- A trucking firm’s recruiting list with more than a thousand drivers’ personal emails
- A contractor’s timesheet app whose code held staff passwords in plain text
Why the Grok Build Links Were Easy to Find
Every published Grok app gets its own web address in the form name.grok.me. Grok suggests random words for the name, which sounds safe, because nobody could guess them. The problem is that the secret part sits in the hostname, and every hostname triggers a DNS lookup the first time someone opens it.
Passive DNS services record those lookups and let paying users search them by pattern. So once a teammate opens a shared app, its address can show up in a searchable list. Claroc says shared links that keep the secret in the page path instead, such as Claude’s published artifacts and ChatGPT or Gemini shared chats, never reach DNS this way.
The default setting made things worse. In Claroc’s paid test account, the publish panel offered three choices, and “Anyone with the link” was already selected. The researchers also built a team app where Grok’s own sign-in code let an uninvited Google account read, edit and delete records.
| Metric | Number |
|---|---|
| Grok app addresses found | 43,601 |
| Apps still online when tested | 37,571 |
| Apps open to anyone | 35,578 (94.7%) |
| Open apps built by SpaceXSI and X staff | 24 |
| Other organizations identified | 30, including 6 Fortune 500 firms |
How SpaceXSI Responded
SpaceXSI did not reply to Claroc’s report directly, the firm says, but it did answer a reporter’s questions. A representative for Cursor, the coding company SpaceXSI recently acquired, said Grok Build apps are private by default and nothing goes public unless the creator chooses to share it. The company also said employee accounts start with “Only you” as the setting.
Claroc disputes that framing. It agrees nothing goes live before a builder clicks Publish, but says the access step that follows already points to “Anyone with the link.” It sent SpaceXSI four suggested fixes, including making “Only you” the default and warning builders when an app has a database but no sign-in.
This is not only a Grok problem. Claroc notes that other app builders, including Lovable, Replit, Bolt and ChatGPT, also give each app its own hostname. It is the second time in a month the firm has found this kind of exposure, after it showed how Meta Muse chats were findable the same way.
What This Means for You
Vibe-coding tools make it easy to turn a spreadsheet into an app in minutes, which is exactly why they leak. Services like Spacefast app hosting and Grok Build put publishing one click away, often without anyone in IT knowing. If you or your team use them, a few quick checks go a long way:
- Open each published Grok app and set access to “Invited users” or “Only you” unless it is truly meant to be public.
- Test the link in a private browser window while signed out, and make sure a stranger gets an error page.
- Never put passwords, patient details or customer lists in an app that has no real sign-in.
- Unpublish old apps nobody owns anymore, since that takes a grok.me address offline right away.
Security teams should also ask which AI app builders employees are using, since most need no company account. Our guide to AI threat detection covers related ways to keep watch, and the agent security tools market is growing fast for this reason.
Sources
Primary source: Claroc’s GhostShares 2 research report. Additional reporting from Ars Technica.
Conclusion
The Grok Build exposure shows how a single default setting can turn a handy feature into a data leak at scale. Tens of thousands of apps were open to anyone who knew where to look, and even SpaceXSI’s own sales team got caught. The company removed its staff apps but has defended the design, so the burden falls on builders for now. If you have ever clicked Publish in Grok, take five minutes today to check who can open what you made. For more stories like this, visit our AI news page.
