Grok · Security · 11 Nov 2026
Security firm says 94.7% of live Grok Build apps opened without sign-in, including 24 from SpaceXSI staff (as of 10 Nov 2026)
A report from security company Claroc, which sells tools for securing AI-built apps, says almost every published Grok Build app it tried could be opened by a stranger, and some held staff lists, sales plans and patient data. SpaceXSI pulled its own employees’ apps after Claroc’s report and questions from Ars Technica, and says apps stay private until their creator shares them. The report does not show that anyone misused the data, and it is not a proven breach.
On this page
The editor holds Tesla and SpaceX shares. Supercharged Daily is independent and not affiliated with either company. Nothing here is financial advice.
What Claroc found
Grok Build lets you describe an app in a Grok chat, have Grok write it, and publish it at its own grok.me address. SpaceXSI opened it to every plan on 19 Aug 2026. In its “GhostShares 2” report, published 10 Nov 2026, Claroc says it collected 43,601 grok.me names and loaded the first page of 43,551 of them, signed in to nothing. 37,571 were still online. 35,578 of those, or 94.7%, opened for anyone. Only 1,993 returned an access-denied error. Those counts are Claroc’s, as of the 10 Nov report.
Most open apps were games, landing pages and calculators. Claroc estimates about 1 in 10 held business or personal data, and roughly 650 to 800 held private data. Examples it says it confirmed by hand include a hospital group’s roster of more than 3,500 staff, a single ICU patient’s briefing, and a timesheet whose code held 18 employee passwords in plain text. It identified 30 organizations besides SpaceXSI and X, six of them in the Fortune 500. Ars Technica, which saw the findings, listed a Tesla service-center scorecard naming 22 technicians with their bonus status.
SpaceXSI’s own apps
24 of the open apps were built by SpaceXSI and X staff, according to Claroc. They included a confidential onboarding plan for a new enterprise sales hire, a territory map of 594 sales accounts, and eight X advertising proposals and decks, one marked confidential and addressed to a U.S. federal agency. Claroc says it reported the issue on 8 Nov 2026 through SpaceXSI’s security contact and sent the other 22 staff apps on 9 Nov. Ars found all 24 still open on the evening of 9 Nov. SpaceXSI began removing them “within a few hours” of Ars emailing questions, and by the time Ars published they returned “app not found.” Apps belonging to other users were left up.
Building apps on grok.com, iOS, and Android is now available on every SuperGrok and X Premium plan
— Grok (@grok) August 20, 2026
One prompt turns an idea into a published product with its own domain.
Post: Grok (@grok), 3:17 p.m. ET on 20 Aug 2026 (12:17 p.m. PT). Embedded from X via x-embed.js. The blockquote is the full post text (the original includes a video and a link).
The default is in dispute
A representative of Cursor, the coding company SpaceXSI recently acquired, told Ars that apps “are private by default and nothing goes public unless the creator chooses to share it.” According to Claroc’s account of SpaceXSI’s answers to a reporter, publishing takes several clicks plus a legal disclaimer, and employee accounts start on “Only you.”
Claroc agrees nothing goes live until someone clicks Publish. Its complaint is the next screen. In the paid account it tested, the access setting came preselected as “Anyone with the link.” The publish sheet pictured on SpaceXSI’s own launch page shows the same value in its Access field. An illustration doesn’t prove what every account sees, but it matches Claroc’s test. As of 11 Nov 2026, SpaceXSI had not announced a change to that default.
Why a “secret” link could be found
According to Claroc, Grok puts the random words at the front of the hostname. The first time someone opens one, the name passes through DNS, and commercial passive DNS services log it where anyone with an account can search by pattern. Links that keep the secret in the path stay out of those logs. Claroc compared how other AI products handle it:
| Product | Where the secret sits | Sharing default Claroc saw |
|---|---|---|
| Grok Build apps | Hostname (under grok.me) | Anyone with the link |
| ChatGPT published apps | Hostname, two levels deep with username | Only me |
| Claude artifacts, ChatGPT and Gemini shared chats | URL path | Not stated |
Claroc says Lovable, Replit, Bolt and others also give each app its own hostname, so the same lookup trick applies to them. It told Ars that Grok is where it found “by far the most sensitive company data.”
What’s proven and what isn’t
Claroc says it loaded each first page once, didn’t sign in to anyone else’s app, and published no addresses. The report doesn’t say whether anyone else found or used these apps, so this remains a report of exposed apps, not a proven breach. Claroc went further on two apps it built itself with made-up data. One stored data with no login, and a stranger could add rows. The other let any Google account sign in, then read, edit and delete records. Claroc tested write access only on its own apps, so it can’t say how many real apps have the same hole.
Claroc asked SpaceXSI to make “Only you” the default, move the secret into the path, add a company-only sharing option, and warn when an app has a database but no sign-in. As of SpaceXSI’s reported response, the company hasn’t said it will change the default or contact app owners. Claroc says it’s notifying affected organizations itself.
If you’ve published a Grok Build app
Open its publish settings and switch anything internal to “Only you” or invited users, then check it from a private browser window. Unpublishing takes an app offline within seconds, Claroc found. If an app’s code ever held passwords or keys, change them.
My read
SpaceXSI’s reported responses don’t dispute Claroc’s numbers. They argue about the default, stressing the steps before publishing, while Claroc’s evidence is about the setting at the last step. The quickest fix is the one SpaceXSI already gives its employees, and even that didn’t keep its own sales plans private. Grok Build reached every plan 81 days before Claroc filed its report on 8 Nov. A new default would only protect apps published from now on. Apps already live keep their current setting until their owners change it, and Claroc notes that SpaceXSI holds the full list of app addresses and can reach those owners.
— Alex R
Sources: Claroc Research, “GhostShares 2” (10 Nov 2026) (Claroc sells security for AI-built apps; every count in this piece is from that report unless stated otherwise); Ars Technica, Dan Goodin (10 Nov 2026); SpaceXSI, “Grok Build on web and mobile” (19 Aug 2026); @grok on X (20 Aug 2026). Related: Grok 4.8 in RL; Grok API watermark. Hero photo: BalticServers.com, CC BY-SA 3.0, via Wikimedia Commons. Never Electrek. No grok.me app addresses are linked or named.
