Grok Build Flaw Exposed 35,000 Apps, Including SpaceXSI's Own Files

By Daniel Okafor

Security researchers found 35,578 Grok Build applications open to anyone with a browser — 94.7% of the apps they tested. The figure comes from Claroc, whose CTO Asaf Aprozper said a passive DNS search returned 43,601 hostnames under grok.me. Of the 37,571 apps still online, only 1,993 returned a 401 authentication error. The rest opened freely.

Grok Build is the AI coding agent from SpaceXSI — the now-merged entity of Elon Musk's SpaceX and xAI, as Ars Technica reports. Claroc describes it as the company formerly called xAI. The exposed apps held confidential documents from SpaceXSI itself, plus sensitive data from Fortune 500 companies, a defense contractor, and healthcare providers.

How did the links leak?

The mechanism is simple. Grok Build lets users describe an app in plain language and publish it with a shareable link. Each link uses a "dice word" scheme — a random phrase like "failing chassis traders" placed as the subdomain, for example https://cinder-crane-sand-frost.grok.me. Possession of the URL was supposed to serve as authorization.

But the randomness sat to the left of the domain, not in the path. Every time someone opened a link, a DNS lookup occurred for a previously unseen hostname. Passive DNS services — which monitor resolver traffic and index hostnames — captured these lookups in publicly searchable databases. Anyone with access to a passive DNS dataset could enumerate the links without guessing anything.

Competing platforms avoid this trap. Claude publishes artifacts at claude.ai/public/artifacts/, ChatGPT shares conversations at chatgpt.com/share/, and Gemini uses gemini.google.com/share/. In each case the secret sits in the URL path, so DNS never sees it.

What did SpaceXSI's own staff expose?

Claroc identified 24 apps built by SpaceXSI and X staff. The list is specific:

• A confidential onboarding plan for a new enterprise sales hire, listing internal system addresses, 19 internal chat channels, and a 30-day plan
• A sales territory map covering 594 strategic accounts
• Eight X advertising proposals and media plans, including one to a U.S. federal agency marked confidential
• Four live advertiser account boards tracking campaign spend, one toward a $1.6 million goal
• Seven campaign reports for advertisers in Brazil, Japan, Korea, and Thailand, several marked confidential or internal
• Two copies of an X brand safety playbook labeled as an internal sales hub

All 24 were accessible on Monday evening. SpaceXSI began removing them within hours of Ars Technica sending questions. By publication, the links returned "app not found" errors.

Who else was affected?

Claroc confirmed sensitive data from roughly 30 other identifiable organizations:

• Tesla: a service-center scorecard naming 22 technicians with productivity and bonus status
• A U.S. Navy ship engineering contractor: a roster of 108 people on a logistics support contract
• A luxury cruise line: a galley checklist listing crew by full name and employee ID
• A healthcare company: a hospital staff app with about 3,565 employees by name and ID
• A Norwegian-Finnish aerospace and defense group: a load board and loading procedure for an explosives building at a U.S. plant, plus an HSE training matrix
• A Peruvian construction company: an occupational-health dashboard with 3,784 worker medical exams

Six of the identified organizations are Fortune 500 companies. Twenty-six have more than 1,000 employees.

Did the defaults cause it?

Claroc's testing found that Grok Build's sharing panel defaults to "Anyone with the link" for paid accounts. The researcher built two test apps; both were published with that default pre-selected.

The company disputes the finding. A Cursor representative — Cursor was recently acquired by SpaceXSI — told Ars that Grok Build apps are private by default and nothing goes public unless the creator chooses to share it. SpaceXSI said publishing requires several steps, including picking an address and accepting a legal disclaimer, and that employee accounts default to "Only you."

Claroc pushes back. In their paid test account, the access step offered three options with "Anyone with the link" already selected. And the 24 open SpaceXSI apps were built by staff — meaning either the employee default was not enforced, or staff manually changed it.

Is this problem unique to Grok?

No. Lovable, Bolt, Replit, v0, Base44, Google AI Studio, and Meta's Muse also give each app its own hostname, making them discoverable via passive DNS. Claroc found that Grok simply had "by far the most sensitive company data" among them. Meta's Muse suspended its link-sharing feature last month after a similar exposure.

What fixes did researchers propose?

Claroc sent SpaceXSI four changes:

• Serve shared apps on unguessable paths under a single host, so links never become DNS names
• Add an "everyone in my organization" option limited to the company's email domain
• Make "Only you" the default and show who can open the app before publish
• Warn at publish when an app has a database but no sign-in

They also demonstrated that Grok's generated code for a team app added any Google account to the team before checking membership — effectively bypassing the access control.

What happens now?

Claroc reported the issue to SpaceXSI's security.txt address on November 8, with the full list of app addresses and an offer to share it privately. SpaceXSI had not replied as of November 10, though it answered a reporter's questions and took down its own 24 apps. It did not say it would notify other affected app owners.

Claroc began notifying organizations directly on November 10. By publication it had emailed three, with more notices going out. It withheld all hostnames, app titles, and identifying details from its public post.

Several questions remain open. Nobody knows how many of the 35,578 open apps hold data visitors could modify or delete — Claroc proved write access only on its own test apps. Nor is it clear whether SpaceXSI will change the default sharing setting or the URL structure for all users, or whether other AI coding platforms will move secrets from hostnames to paths.

SpaceXSI's job postings describe Grok Build as part of a "full Super Intelligence stack" alongside Grok models, Grok Bot, Grok Imagine, Grok Voice, and X. The exposure shows the platform's publishing defaults and link architecture did not match the sensitivity of the data its own teams were loading into it.