AI News · 5 min read
Grok apps on grok.me were open to anyone with the link
Claroc found 35,578 of 37,571 live Grok apps open with no sign-in. SpaceXSI removed 24 staff apps after Ars asked. Anyone with the link was preselected.
What Claroc counted
On November 10, 2026, Asaf Aprozper of Claroc Research published GhostShares 2 ↗. Describe an app in Grok's chat, Grok writes it, and publishing puts it on its own subdomain of grok.me. Claroc listed 43,601 names and, on November 8, tried 43,551 addresses. 37,571 were online. 35,578 (94.7%) opened with no sign-in. 1,993 (5.3%) returned HTTP 401.
Most open apps were games, landing pages, and calculators. Claroc estimates about 1 in 10 held sensitive material, about 2% rated high or critical, and roughly 650 to 800 apps held private data, including staff rosters and, in one contractor timesheet, passwords in the script the browser downloads.
24 open apps belonged to SpaceXSI and X staff: a confidential onboarding plan, a sales map of 594 accounts, and eight X ad proposals, one of them to a U.S. federal agency and marked confidential. Ars Technica ↗ (Dan Goodin, November 10) reported that SpaceXSI began removing those 24 within hours of Ars's email. Claroc says other users' apps stayed up. Ars also reported a Tesla service-center scorecard naming 22 technicians.
The name is disputed
Claroc describes Build mode: an app made in chat and published from that chat. Ars's headline calls it the "Grok Build coding agent." heise online ↗ (November 11) headlines "Grok Build." The Hacker News ↗ (November 11) headlines "Grok-Built Apps" and says the chat builder shares that name with a separate terminal tool.
The Verge ↗ (November 11, 20:54 UTC) reports a post in which Grok said the Ars article was "incorrect," referring to the "app builder feature on grok.com, not Grok Build." The Verge adds that Grok said users review sharing settings and a warning before publishing.
A reply from the @grok account ↗ at 12:22 UTC the same day still said "Grok Build." It is that account's reply, separate from a SpaceXSI statement: "The Claroc report is accurate on the numbers: most published Grok Build apps used the "Anyone with the link" setting and were reachable via their *.grok.me hostnames, which passive DNS can index. SpaceXSI removed its own 24 staff apps."
Here they are Grok apps: the app builder on grok.com, published on grok.me.
Why a link was not a lock
The secret is the subdomain. Claroc says Grok proposes four random words, and the first visit lands in passive DNS, where a pattern search lists it. Claude artifacts, ChatGPT shared chats, and Gemini shares keep the random part in the path, Claroc writes, so DNS misses it.
ChatGPT apps also use a hostname. Claroc's Share panel was Only me until changed. Lovable, Replit, Base44, Google AI Studio, Muse, v0, and Bolt use per-app hostnames too. Ars quotes Aprozper on Lovable, Bolt, and Replit: they "also give each app its own web address, so the same DNS records expose them, too. However, Grok is where we found by far the most sensitive company data."
What SpaceXSI and Cursor said
Claroc wrote security.txt on November 8 and sent the other 22 staff apps on November 9. On November 10 the company answered a reporter. Claroc says the security.txt thread stayed unanswered. Claroc's account: apps stay private until the creator shares one; publish takes several steps, including a legal disclaimer; employee accounts default to Only you.
In the paid account Claroc used, the panel listed Anyone with the link, Invited users, and Only you, with Anyone with the link already selected. Building worked on the free plan. Publishing required a paid plan. The 24 staff apps were open anyway. Prices checked November 5 are in the Grok 4 review.
Ars calls Cursor "the AI coding service SpaceXSI recently acquired" and quotes a representative: apps "are private by default and nothing goes public unless the creator chooses to share it." Ars says Claroc's tests contradict that.
On Claroc's own contact-list app, a signed-out visitor added a row. A team list's "Continue with Google" and "Continue with X" added the signer to the team before checking membership. An uninvited Google account read every row, edited one, and deleted another. Claroc says it did this only on its own apps.
Check your Grok apps now
Set any app with company or personal data to Invited users or Only you. Claroc's test app then returned HTTP 401 to a stranger, on the page and the data function.
Unpublish anything with no owner. Claroc's second test app went offline within seconds.
Delete secrets from scripts the page loads. Claroc found plaintext passwords in a timesheet script.
In a signed-out window, confirm the error. Then sign in from an outside account. If that account edits rows, sign-in is not an allow-list. Claroc saw that only on an app it had built.
What people are saying
"Root cause: treating a URL as a security boundary. URLs leak — proxy logs, browser history, referrers, chat threads." wrote Password Pusher ↗.
"Claroc reported the Grok Build leak and got silence. Ars emailed questions, and within hours SpaceXSI's own 24 apps went dark." wrote @yonnuta ↗.
"Ask what they published; set Grok apps with company data to Invited users or Only you." wrote @syslog_eu ↗.
Reddit was not reachable for this story.
Our take
Treat a published grok.me app as public hosting until ordinary accounts default to Only you. Employee accounts are a separate default in what SpaceXSI told a reporter, and 24 staff apps were still open until Ars asked.
The preselected setting is the part Claroc pinned on Grok. Lovable, Replit, and Bolt also publish to per-app hostnames. ChatGPT's default, in Claroc's test, was Only me. Cursor Build Live Apps puts private and team apps behind Cursor SSO and runs security checks before publish. See the no-code agent builder review. Grok Bot calls and the API watermark are separate November changes.
Claroc asked for a path secret, an org-domain option, an Only you default, and a warning when an app stores data with no sign-in. Run the checklist until those exist.