Grok Build left more than 35,000 AI-made apps open to anyone, researchers say

Tens of thousands of web apps built with Grok Build, the AI coding agent from Elon Musk's SpaceXSI, could be opened by anyone on the internet, according to new research from security firm Claroc. Some of them held hospital staff lists, patient details, plaintext passwords and confidential sales material belonging to SpaceXSI itself.

Claroc said it found 43,601 app addresses ending in grok.me. Of those, 35,578, or 94.7%, loaded without asking for any login, exposing whatever data the apps stored or generated. Roughly one in 10 contained sensitive or internal business information, and 2% exposed material Claroc rated high or critical in severity.

The scale is the headline, but the cause is the real story. Nobody had to guess passwords or break in. The addresses were sitting in public databases, and the apps behind them were open by design.

How random addresses ended up in public view

Grok Build is a vibe-coding tool: users describe an app in a chat window, and the agent writes and publishes it within minutes, without the user touching any code. Each published app gets its own web address made of randomly generated "dice words" followed by grok.me, such as cinder-crane-sand-frost.grok.me. Users can edit the words.

The randomness is meant to work like a hard-to-guess key. Security engineers call this capability-based access control: knowing the link is what grants entry. A three-word phrase of that kind carries roughly 38 bits of entropy, which works out to billions of possible combinations. Google Docs relies on the same idea, with a long random string in its share links.

The difference is where the secret sits. Google puts its random string in the path, after the domain name. Grok Build puts it in the hostname, before grok.me. Every time a device looks up a new hostname, that lookup can be captured by passive DNS services, which log domain names seen in internet traffic and make them searchable. So the moment someone opened a Grok Build app, its supposedly secret address could land in a public index.

That is how Claroc built its list without anyone sharing a link with it. Other AI products avoid the problem by keeping the secret in the path, where DNS never sees it: Claude's published artifacts, ChatGPT's shared conversations and Gemini's share links all work that way.

This is the most damning part of the findings. A random name is a sound idea, but putting it in the one part of a web address that gets broadcast to DNS infrastructure undoes the protection. That looks like an architecture mistake, not a user error, and it means the longer a Grok Build app is used, the more likely its address has already been logged.

A default setting in dispute

Discoverable addresses would matter less if the apps required a login. Most did not. When publishing, Grok Build offers three choices: "Anyone with the link," "Invited Users" and "Only You." Asaf Aprozper, Claroc's co-founder and chief technology officer, said his tests over the past week showed the first option was selected by default.

A representative for Cursor, the AI coding company SpaceXSI recently acquired, disputed that in an email to Ars Technica, saying Grok Build apps "are private by default and nothing goes public unless the creator chooses to share it." Ars reported that Aprozper's tests contradicted the statement, finding that in every case users had to switch away from the open setting themselves. The representative did not answer the outlet's follow-up questions, including whether SpaceXSI planned to notify customers whose data was exposed.

Claroc's numbers weigh against the company's account. If nothing went public without a deliberate choice, it's hard to explain why nearly 95% of discoverable apps were open. A more plausible reading is that people building quick internal tools clicked publish without studying the sharing menu, which is exactly the situation where a default decides the outcome.

What leaked, including SpaceXSI's own files

Claroc's examples show how far beyond toy projects these apps reached. It found a hospital employee directory listing more than 3,500 names, an intensive care briefing containing patient information, medical exam results and a trucking company's recruitment database covering more than 1,000 people. One employee timesheet app included downloadable code with 18 accounts and their passwords in plain text, among them administrator credentials. Galley checklists from a cruise line also turned up. Some of the affected users worked at Fortune 500 companies and a defense contractor, according to Claroc.

SpaceXSI, formed through the merger of SpaceX and xAI, was among the exposed. Claroc counted 24 open apps from the company, containing a confidential onboarding plan for a new enterprise sales hire, a sales territory map covering 594 accounts and their pipeline, internal addresses for sales tools, advertising proposals and media plans with budget tiers, including one marked confidential for a U.S. federal agency, and seven campaign reports for advertisers.

"We were shocked," Claroc wrote in a post about the findings. The firm noted that a sales tool bought from a vendor would have sat behind company sign-in. "Built with AI, it went live open to anyone with the link," it said.

That line captures the risk better than any statistic. AI coding agents let employees spin up working software that never goes through the security review a purchased tool would. When even the platform's own sales team ships apps this way, the problem clearly isn't careless outsiders.

Read-only access wasn't the only concern. Claroc built two test apps of its own. One let unauthenticated visitors edit a shared contact database. The other automatically let in anyone who signed in with a Google account, even people outside the team.

Who got fixed first

Claroc said it notified SpaceXSI on Sunday, Nov. 8. With no reply, a Claroc official tagged Musk and Grok manager Matt Palmer on X. The 24 SpaceXSI apps were still exposed Monday evening. Ars Technica reported that SpaceXSI began pulling those links within hours of the outlet emailing questions, and by the time its story ran Tuesday, all 24 returned an "app not found" error.

At that point, almost all of the other exposed data was still reachable. The order of that cleanup should worry Grok Build customers: the company's own files came down quickly, while the thousands of apps built by its users remained open. Claroc said it is working through the list and contacting affected organizations itself. Aprozper said the chief information security officer at a luxury cruise company "pulled in their whole security team" once Claroc shared its findings.

Grok Build is not the only exposed platform. Aprozper said Lovable, Bolt and Replit also give each app its own web address, so the same DNS records reveal them, though Grok was where Claroc found "by far the most sensitive company data." Meta recently suspended a link-sharing feature in its Muse agent after it, too, was found leaking sensitive data.

For now, Grok Build users can switch any app not meant for the public to "Invited Users" or "Only You." That closes the door the default left open, but not the deeper flaw: as long as the secret lives in the hostname, every new app address risks becoming public the first time someone visits it, and that is a fix only SpaceXSI can make.