CodingSoftware & developer tools
Grok Build apps left confidential data open to anyone with the link, including SpaceXSI's own sales material
A security firm found tens of thousands of Grok Build apps reachable without a login, including 24 built by SpaceXSI staff that held sales data. The random share names sat in hostnames, which passive DNS services record and make searchable.
From the Ars Technica · AI article of November 10, 2026 and cited sources: Claroc collected 43,601 grok.me app hostnames from passive DNS records. [2] [1] [5]
SOURCES[2] Claroc: Grok Apps Exposed xAI Secrets and Private Data blog.claroc.io[1] Grok Build coding agent leaks oodles of confidential info… arstechnica.com[5] Engadget: A Grok vibe-coding agent leaked sensitive… engadget.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- Ars Technica · AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 10, 2026 article published
- Covered
- Nov 11 edition
- Evidence
- 7 sources across 7 sites
- 1Grok Build coding agent leaks oodles of confidential info…arstechnica.com
- 2Claroc: Grok Apps Exposed xAI Secrets and Private Datablog.claroc.io
- 3The Register: SpaceX open-sources Grok Build after data…theregister.com
- 4eWeek: Meta Muse Pauses Sharingeweek.com
- 5Engadget: A Grok vibe-coding agent leaked sensitive…engadget.com
- 6The Next Web: Grok Build was uploading entire Git…thenextweb.com
QuietHow it’s measured
Hacker News · 4 likes
Reach blends public engagement (views, likes, comments, shares, stars) from the platforms where the story or its original source lives: YouTube, Hacker News, GitHub, Substack and similar. A video and the article written from its transcript share one score, taken from the video. Platforms with no data are left out rather than counted as zero, and the age of a story never lowers its score.
Claroc collected 43,601 grok.me app hostnames from passive DNS records. Of the 37,571 apps still live, 35,578 opened without a login. Claroc estimates 650–800 of them held sensitive material, such as medical exams, defense-contractor rosters and employee IDs, across 30 identifiable organizations. Those organizations include six Fortune 500 companies. These counts come from Claroc alone; the outlets that reported them did not reproduce them. [2] [1] [5]
Each app's random dice-word name, about 38 bits of randomness, was part of the subdomain. DNS lookups expose subdomains, and passive DNS services log them in searchable databases, so the strength of the randomness offered no protection. Claude, ChatGPT and Gemini avoid this by putting the share secret in the URL path, which follows the long-standing rule that secrets should stay out of logged URLs. [1] [7]
SpaceXSI staff had built 24 exposed apps. They included a confidential onboarding plan and a map of 594 sales accounts. The company took them down within hours of a press inquiry on November 10, but other users' exposed apps were reported still online a day later. Whether sharing is private by default is disputed: a Cursor representative says it is, but Claroc's tests found link sharing preselected. [1] [2] [5]
The evidence shows that share links placed in hostnames can be discovered no matter how random they are, and SpaceXSI removed its own apps once questioned.
Read the full assessment
The implication is that AI app builders can publish internal data outside company logins, so security teams should find and test these apps.
Executive brief
Security firm Claroc found that SpaceXSI's own staff had built 24 Grok Build apps whose internal sales material was readable by anyone with the link. One was a confidential onboarding plan; another was a map of 594 sales accounts. Overall, Claroc's write-up found 43,601 app addresses on grok.me through public DNS records, and 35,578 of them opened without a login. The apps held medical exams, defense-contractor rosters and employee IDs. The random names worked as intended. The problem was where they sat in the address: in the hostname, which shows up in DNS lookup logs, rather than in the path after the domain (Ars Technica).
What changed and event timeline
An earlier Grok Build privacy failure
Researchers found the Grok Build command-line tool uploading whole Git repositories to the company's cloud. SpaceX then deleted the retained data and released the tool as open source ().
The same flaw at Meta
Claroc found about 6,800 share links for Meta's Muse AI agent in DNS records, and Meta paused sharing ().
SpaceXSI notified
Claroc reported its findings through the company's security.txt contact. On November 9 it reported 22 more apps built by staff (). After getting no reply, a Claroc official tagged Elon Musk and Grok manager Matt Palmer on X ().
Research published; SpaceXSI pulls its own apps
Within hours of an email from Ars, SpaceXSI's 24 apps began returning "app not found." Most other exposed apps stayed online ().
Other users' apps reported still open
Claroc said SpaceXSI had not taken down apps left open by other users and organizations ().
Capabilities and access
- Grok Build is a "vibe-coding" agent: users describe an app by speech or text and get a working version within minutes.
- Sharing has three settings: "Anyone with the link," "invited users," or "only you" (same source).
- The open-source release in July was 844,530 lines of Rust (The Register).
Read the full section
- Grok Build is a "vibe-coding" agent: users describe an app by speech or text and get a working version within minutes. Each app is published at an address like
<dice-words>.grok.me(Ars Technica). - Sharing has three settings: "Anyone with the link," "invited users," or "only you" (same source).
- The open-source release in July was 844,530 lines of Rust (The Register).
- None of the reviewed sources names the underlying Grok model or version.
Technical analysis for researchers and developers
- A link that is hard to guess can act as the access key. That only holds if the secret part never appears anywhere public.
- Ars puts three random dice words at roughly 38 bits. That is irrelevant once the name has been logged.
- It collected grok.me names from passive DNS and loaded the first page of each app in a private browser window without logging in.
Read the full section
- How the exposure works. A link that is hard to guess can act as the access key. That only holds if the secret part never appears anywhere public. A hostname is looked up through DNS, and passive DNS services record new names in searchable databases. So randomness in the subdomain is exposed no matter how strong it is. Putting the secret in the path avoids this. Claude artifacts, ChatGPT shares and Gemini shares all do that (Ars Technica).
- Entropy doesn't help. Ars puts three random dice words at roughly 38 bits. That is irrelevant once the name has been logged.
- Claroc's method. It collected grok.me names from passive DNS and loaded the first page of each app in a private browser window without logging in. An AI model flagged pages that looked sensitive, and humans then checked them (Claroc).
Claims and evidence
- Of 37,571 apps still live, 35,578 (94.7%) opened without a login and 1,993 returned an authorization error. Claroc estimates 650–800 held sensitive material (Claroc).
- Claroc counted 30 identifiable organizations with exposed data, including six Fortune 500 companies (Engadget).
- The default setting is disputed. Claroc's tests found "Anyone with the link" preselected (Ars Technica; Claroc).
Read the full section
- Of 37,571 apps still live, 35,578 (94.7%) opened without a login and 1,993 returned an authorization error. Claroc estimates 650–800 held sensitive material (Claroc). These figures come from Claroc alone. Ars and Engadget repeat them but did not reproduce them.
- Claroc counted 30 identifiable organizations with exposed data, including six Fortune 500 companies (Engadget).
- The default setting is disputed. A representative of Cursor, which Ars says SpaceXSI recently acquired, said apps are private by default. Claroc's tests found "Anyone with the link" preselected (Ars Technica; Claroc).
- One outside sign supports the SpaceXSI finding: the company took down its 24 apps after Ars asked about them.
Context and prior work
- Claroc used the same passive-DNS method against Meta's Muse a month earlier.
- Grok Build has had trouble before: in July it defaulted to uploading full repositories, including their commit history (The Next Web).
- The underlying principle, that secrets should not be placed in URLs that get logged, is long established (Password Pusher).
Read the full section
- Claroc used the same passive-DNS method against Meta's Muse a month earlier. There, descriptive titles placed in the hostname made about 6,800 links findable (eWeek).
- Grok Build has had trouble before: in July it defaulted to uploading full repositories, including their commit history (The Next Web).
- The underlying principle, that secrets should not be placed in URLs that get logged, is long established (Password Pusher).
Limitations, safety and contested findings
- Claroc sells security monitoring, so it benefits commercially from these findings.
- The sensitivity estimates relied partly on AI flagging and on reviewing only each app's first page.
- Claroc says Lovable, Bolt and Replit also give each app its own hostname, so the same DNS exposure applies to them.
Read the full section
- Claroc sells security monitoring, so it benefits commercially from these findings.
- The sensitivity estimates relied partly on AI flagging and on reviewing only each app's first page.
- Claroc says Lovable, Bolt and Replit also give each app its own hostname, so the same DNS exposure applies to them. It says Grok held "by far" the most sensitive data. It did not publish comparable numbers for those platforms (Ars Technica).
- Engadget reports that about 2% of the exposed material was rated high or critical severity (Engadget).
Business and practitioner implications
- Apps built with AI tools skip the company login that bought software would normally sit behind.
- For security teams: list every AI app builder in use, search passive DNS for your organization's apps on those platforms, test whether they open without a login, and remove apps with no clear owner.
- For Grok Build users: set sharing to invited users only unless the app is meant to be public (Ars Technica).
Read the full section
- Apps built with AI tools skip the company login that bought software would normally sit behind. Claroc's point is that the sales team's tool went live open to anyone with the link (Claroc).
- For security teams: list every AI app builder in use, search passive DNS for your organization's apps on those platforms, test whether they open without a login, and remove apps with no clear owner.
- For Grok Build users: set sharing to invited users only unless the app is meant to be public (Ars Technica).
- For platform builders: keep share secrets in the URL path, not the hostname, and make private the default.
The source trail.
Sources (7)
Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Article text retrieved; extracted text may omit tables or interactive elements.
arstechnica.com