Credit: Samuel Boivin / Shutterstock Anyone who found the address of a Grok Build app could open more than 35,000 of them, security firm Claroc found in research published on 10 November. Two dozen belonged to staff at SpaceXSI, the company that makes Grok. They held a confidential onboarding plan, a sales territory map and advertising proposals. SpaceXSI took its own 24 apps offline after the report, Claroc said.
It left the apps of other Grok users open. Ars Technica’s Dan Goodin reported that SpaceXSI started removing them within hours of his email asking about the findings. What was open Grok Build turns a description typed into a chat into a working app. The user can then publish it at its own address on grok.me.
Claroc tried more than 43,500 of those addresses. Of the 37,571 still online, 35,578, or 94.7%, opened without any sign-in. Most were games, landing pages and calculators. About one in ten held internal business or personal data.
Claroc estimates that 650 to 800 apps held private data. Claroc confirmed some cases by hand. They included one intensive care patient’s lab results, a hospital group’s roster of more than 3,500 staff, and a fire department’s shift board. One contractor’s timesheet app carried 18 accounts with their passwords in plain text, in code that every visitor’s browser downloads.
Besides SpaceXSI and X, Claroc identified 30 organisations, six of them in the Fortune 500. It named none. Ars Technica listed more. They include a Tesla service-centre scorecard naming 22 technicians and a roster for a US Navy logistics contract.
SpaceXSI’s own open apps included a map of 594 strategic sales accounts and eight X advertising proposals. Claroc said one proposal, to a US federal agency, carried a confidential label. How the apps were found Grok gives every published app its own hostname of random words, such as name.grok.me. Nobody needs to guess one.
When a visitor opens an app, its name reaches passive DNS services. These commercial databases log internet lookups, and anyone with an account can search them. Shared chats from Claude, ChatGPT and Gemini keep the secret part of the link in the path, Claroc said. DNS never sees it.
Last month, the same method exposed Meta’s Muse links. In the paid account Claroc used, the publish screen proposed “Anyone with the link” as the access setting. It also offered “Invited users” and “Only you”. “AI app builders turned publishing into a few clicks, and the default answer to who can see it is everyone,” Asaf Aprozper, Claroc’s co-founder and chief technology officer, said in the firm’s report. Claroc also built two test apps of its own.
In a team customer list, Grok’s code added anyone who signed in with Google to the team before checking membership. An outside account could then read, edit and delete records, the firm said. What SpaceXSI says A representative for Cursor, the coding company SpaceX bought in August, responded in an email to Ars Technica. “Apps are private by default and nothing goes public unless the creator chooses to share it,” the representative said, according to Ars Technica. SpaceXSI also told a reporter that publishing takes several steps, including a legal notice, and that employee accounts start on “Only you”, Claroc said.
Claroc’s answer is that the people who published the 35,578 open apps went through every one of those steps. The representative said ChatGPT, Lovable and Bolt also make shareable links. Aprozper agreed that apps on Lovable, Bolt and Replit have the same exposure. “However, Grok is where we found by far the most sensitive company data,” Aprozper told Ars Technica. Claroc sells security tools for AI-built apps.
It asked SpaceXSI to make “Only you” the default, move shared apps onto hard-to-guess paths, and warn builders when an app has a database but no sign-in. It is now notifying the affected organisations itself. It is not the first data problem for Grok Build. In July, the tool sent entire Git repositories to xAI’s servers.
In October, Musk said the merged company would be renamed SpaceXSI. Get the TNW newsletter ✕ Close Get the TNW newsletter Get the most important tech news in your inbox each week.
Leave a Reply