Researchers Say Over 35,000 Grok Apps Opened to Anyone, Including SpaceXSI Staff Apps
Security firm Claroc says 94.7 percent of live Grok Build apps it tested opened without a sign-in, including 24 confidential apps from SpaceXSI and X staff that the company later took down. Apps from other users were still open at publication.
The company that makes Grok left its own sales secrets on the open web. Security firm Claroc says it found 24 apps built by SpaceXSI and X staff with Grok Build that anyone could open without signing in, among them a confidential onboarding plan for a new enterprise sales hire, a sales territory map covering 594 accounts, and an X advertising proposal to a U.S. federal agency marked confidential.
Those 24 were a rounding error in a much bigger pile. In a report published November 10, Claroc co-founder and CTO Asaf Aprozper said the firm tried 43,551 Grok app addresses. Of the 37,571 still online, 35,578, or 94.7 percent, opened for anyone. Only 1,993 answered with the error an app set to Only you or Invited users returns.
The contents matter more than the count. Claroc says most open apps were games, landing pages and calculators. About 1 in 10 held internal business or personal data, and the firm estimates roughly 2 percent held material serious enough to rate high or critical. It puts the total at roughly 650 to 800 apps with private data.
That smaller slice is still ugly. Claroc says it confirmed by hand a hospital group roster of more than 3,500 employees, an intensive care briefing for a single patient with labs and ventilator status, a fire department shift board, and a contractor timesheet whose code held staff passwords in plain text. Beyond SpaceXSI and X, it says it could identify internal data from 30 organizations, 26 with more than 1,000 employees and 6 in the Fortune 500, across construction, energy, healthcare and defense. Claroc names none of them and withheld every app address from its report. We are doing the same.
A random name is not a lock
Grok Build turns a chat prompt into a working app and publishes it on its own subdomain of grok.me, with a name that is often four random words. Hard to guess. But Claroc argues that once an app is opened, its name lands in commercial DNS lookup records that can be searched, so secrecy by obscurity falls apart. Ars Technica called that placement of the randomness a fatal flaw, noting that Claude artifacts, ChatGPT shared conversations and Gemini shares keep the secret part of the link in the path, where DNS never sees it.
That turns the access setting into the real control, and here the two sides flatly disagree. Claroc says that in the paid account it used, clicking Publish offered Anyone with the link, Invited users and Only you, with Anyone with the link already selected. A Cursor representative, speaking for the AI coding service SpaceXSI recently acquired, told Ars otherwise.
"Apps are private by default and nothing goes public unless the creator chooses to share it." Cursor representative, to Ars Technica
According to Claroc, the company also said publishing takes several steps, including a legal disclaimer, and that employee accounts default to Only you. Both sides agree nothing goes live until a builder clicks Publish. Claroc's retort is that extra clicks ending on a setting already pointed at everyone protect nothing, and that the staff default did not keep SpaceXSI's own 24 apps closed.
"AI app builders turned publishing into a few clicks, and the default answer to who can see it is everyone." Asaf Aprozper, Claroc Research
Claroc says it reported the issue to SpaceXSI on November 8 and flagged the remaining staff apps on November 9. Ars reports that the 24 staff apps began disappearing within hours of its own questions and returned an app not found error by publication, while almost everything else stayed up. Claroc says the company never said it would contact other app owners, so the firm started emailing affected organizations itself and had reached three by publication. The Cursor representative did not tell Ars whether SpaceXSI would notify customers.
This is Claroc's second act. Last month the same firm found pages shared from Meta's Muse agent exposed the same way, and Meta paused Muse sharing in response. SpaceXSI scrubbed its own embarrassments fast. Whether it moves as fast for the thousands of customers still exposed is the part worth watching.
