Grok Build, the vibe-coding agent operated by SpaceXSI, has been leaking sensitive data from thousands of user apps through its share-link system, according to new research from security firm Claroc - and the platform's own maker was among the victims. The findings, published November 10 as the second installment of Claroc's GhostShares series, describe a design flaw that turned "unguessable" URLs into a searchable catalog of live corporate and personal data.
The numbers are stark. Claroc enumerated 43,601 app addresses ending in grok.me and tested 43,551 of them. Of the 37,571 apps still online at test time, 35,578 - or 94.7% - opened for a total stranger with no sign-in. Most were harmless games, landing pages and calculators, but Claroc estimates roughly one in ten held sensitive business or personal data, or 650 to 800 apps, with about 2% rated high or critical.
The sharpest embarrassment is self-inflicted. Claroc found 24 apps built by SpaceXSI and X staff, including an onboarding plan marked confidential for a new enterprise sales hire, a sales territory map covering 594 accounts, internal system addresses for sales tools, and advertising proposals - one marked confidential and addressed to a US federal agency. The company took all 24 apps down within hours of Ars Technica sending questions for its report. Before that, Claroc had notified SpaceXSI on Sunday and, receiving no response, publicly tagged Elon Musk and Grok manager Matt Palmer on X.
Other organizations were exposed too. Claroc says it identified 30 organizations with internal data in open apps, including six Fortune 500 companies. Confirmed examples include a Peruvian construction company's occupational-health dashboard covering 3,784 worker medical exams, a Tesla service-center scorecard naming 22 technicians with productivity and bonus status, a hospital staff app listing about 3,565 employees by name and ID, a US Navy ship engineering contractor's roster of 108 contract personnel, and a trucking firm's recruiting list with more than a thousand drivers' personal emails. Unlike SpaceXSI's apps, those belonged to ordinary users and were not taken down.
The root cause is architectural. Every published Grok app gets its own hostname like name.grok.me, with random "dice words" such as cinder-crane-sand-frost intended to make the URL unguessable. But the secret sits in the hostname, and every hostname triggers a DNS lookup the first time someone opens the app. Passive DNS services record those lookups and let paying users search them by pattern - so once a teammate opens a shared app, its address becomes discoverable. On top of that, Claroc's test account showed the publish flow defaulting to "Anyone with the link." A Cursor representative said Grok Build apps are private by default and employee accounts start at "Only you," a framing Claroc disputes. The firm sent SpaceXSI four suggested fixes, including making "Only you" the default and warning builders when an app holds a database but has no sign-in.
Claroc notes the hostname pattern is not unique to Grok: Lovable, Replit, Bolt and ChatGPT's app canvas all give each app its own hostname, while Claude's published artifacts and ChatGPT or Gemini shared chats keep the secret in the page path and never reach DNS. It is the firm's second such find in a month, after demonstrating that Meta Muse chats could be enumerated the same way.
The episode lands at a moment when vibe-coding tools are being adopted by business users who have no reason to think about URL semantics. When an employee pastes a client list into a prompt to build a sales dashboard, the platform's sharing model - not the employee's judgment - decides who can see it. Until SpaceXSI confirms a fix and explains how long the flaw existed, anyone who has published a Grok Build app touching real business data should treat that data as potentially exposed.
Comments (0)
Log in to join the discussion
Log InNo comments yet