Claroc found 35,578 Grok Build apps open without sign-in

Security firm Claroc reported on Tuesday that 35,578 of 37,571 live Grok Build apps could be opened from the public internet without sign-in. It had listed 43,601 app addresses under grok.me; only 1,993 live apps returned an access-denied error, putting public exposure at 94.7%.

Grok Build is the vibe-coding agent from SpaceXSI, the now-merged SpaceX and xAI, and grok.me hosts apps users create by describing them in chat. Random hostnames made discovery obscure. They did not make the apps private.

How did public apps become searchable?

Each published Grok app receives a hostname built from four random words plus grok.me. Every visit triggers a DNS lookup, and passive DNS services collect those lookups in pattern-searchable databases available to anyone with an account.

That resembles finding a mailbox in a public postal directory rather than guessing a password. Ars Technica noted that Google Docs, Claude’s published artifacts and ChatGPT shared conversations keep the secret part of the link in the path, which DNS never sees. Claroc said Lovable, Replit and Bolt also assign each app its own hostname.

Was sharing the default?

In Claroc’s paid account, the publish panel preselected “Anyone with the link”; its other choices were “Invited users” and “Only you.” SpaceXSI said Grok apps remain private until their creator shares one, publishing involves several clicks and a legal disclaimer, and employee accounts default to “Only you.”

Cursor, the coding company SpaceXSI recently acquired, offered a similar account. A representative said apps “are private by default and nothing goes public unless the creator chooses to share it,” then did not answer follow-up questions. Those accounts and the observed panel produced two different pictures of the same product.

What did SpaceXSI expose?

Claroc found 24 open apps built by SpaceXSI and X staff. Their contents included:

• An onboarding plan marked confidential for a new SpaceXSI enterprise sales team member, listing internal system addresses, sales tools and 19 internal chat channels.
• A map of 594 strategic sales accounts and their pipeline.
• Eight X advertising proposals and media plans, including one marked confidential for a U.S. federal agency.
• Four live advertiser boards showing campaign spend.
• Campaign reports for advertisers in Brazil, Japan, Korea and Thailand.

Claroc co-founder and chief technology officer Asaf Aprozper gave the security firm’s verdict. He wrote: “We were shocked. The company that makes Grok had its own internal material open to anyone holding the link, and we had never been given it.”

Claroc said it reported the problem to SpaceXSI through the address in its security.txt file on Nov. 8, then sent details on the other 22 staff apps on Nov. 9. Ars Technica found all 24 still exposed on Monday evening. SpaceXSI began removing their links within hours of Ars emailing questions, and by publication they returned an “app not found” error.

SpaceXSI removed links to its staff apps after the reports but did not remove open apps belonging to other users. The distinction matters. An internal cleanup does not address 35,000-odd public links.

How far did user data spread?

Most open apps were games, landing pages and calculators. Claroc estimated that about one in 10 held sensitive business or personal data and that roughly 650 to 800 held private data. It then confirmed several cases by hand:

• A hospital group’s roster of more than 3,500 employees.
• An intensive care briefing for one patient, including laboratory results and ventilator status.
• A fire department’s live shift board with badge numbers.
• A contractor’s timesheet whose code held 18 employee accounts with plain-text passwords.

Besides SpaceXSI and X, Claroc identified 30 organizations with internal data in open apps. Twenty-six had more than 1,000 employees, and six were Fortune 500 companies. Claroc did not name them.

Separate examples cited by Ars Technica included:

• A Tesla service-center scorecard naming 22 technicians with productivity and bonus status.
• 3,784 worker medical examinations from a Peruvian construction company.
• A load board for an explosives building at a U.S. plant run by a Norwegian-Finnish defense group.

Did the sign-in checks work?

Claroc built two test apps of its own. In one team app, Grok added Google and X sign-in, but the code added anyone who signed in to the team before checking membership. An uninvited Google account could therefore read, edit and delete records. Claroc said it ran write tests only on its own apps.

What happens next?

Claroc asked SpaceXSI to serve apps under a path on one host, add an organization-only sharing option, make “Only you” the default and warn when an app has a database but no sign-in. SpaceXSI had not said it would contact owners of the other open apps. Claroc had begun notifying affected organizations itself and had emailed three by publication.

Privacy trouble predates this report. In July, a researcher found that the Grok Build command-line tool uploaded developers’ entire repositories, including Git history and committed secrets, to company cloud storage. Elon Musk said the uploaded data would be deleted. Separately, MLQ.ai covered xAI’s cuts to Grok usage quotas earlier this month.

Until SpaceXSI changes the publish default and adds owner-level warnings, Claroc’s notifications, not a broad cleanup, define the remaining exposure. With rival builders also assigning hostnames, Grok now faces privacy defaults as a competitive variable, not merely a security footnote.