Claroc opened 35,578 published Grok apps without signing in, including SpaceXSI sales plans, employee rosters, medical data and plain-text passwords.
By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
· Published
Primary source: [arstechnica.com](https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/)
Why it matters #
AI app builders let employees publish working internal tools in minutes, outside normal IT review, and Grok's hostname-based sharing made those tools enumerable through passive DNS. A sales map, a patient briefing and a staff roster can all end up behind the same public link pattern.
Security firm Claroc found 35,578 apps built with SpaceXSI's Grok Build open to anyone on the public internet without a sign-in, including 24 apps built by SpaceXSI and X staff that held a confidential sales onboarding plan, a territory map covering 594 accounts and advertising proposals. Claroc published the research on November 10th, 2026, and Ars Technica reported it the same day.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.