# 35,578 Grok Build apps opened without sign-in, including SpaceXSI's own sales plans

> Source: <https://runtimewire.com/article/grok-build-apps-exposed-passive-dns-claroc-spacexsi>
> Published: 2026-11-10 23:44:07+00:00

# 35,578 Grok Build apps opened without sign-in, including SpaceXSI's own sales plans

**Claroc opened 35,578 published Grok apps without signing in, including SpaceXSI sales plans, employee rosters, medical data and plain-text passwords.**

        By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
        · Published 

Primary source: [arstechnica.com](https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/)

## Why it matters

AI app builders let employees publish working internal tools in minutes, outside normal IT review, and Grok's hostname-based sharing made those tools enumerable through passive DNS. A sales map, a patient briefing and a staff roster can all end up behind the same public link pattern.

Security firm Claroc found 35,578 apps built with SpaceXSI's Grok Build open to anyone on the public internet without a sign-in, including 24 apps built by SpaceXSI and X staff that held a confidential sales onboarding plan, a territory map covering 594 accounts and advertising proposals. Claroc [published the research](https://blog.claroc.io/ghostshares-grok-build-apps/) on November 10th, 2026, and [Ars Technica reported it](https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/) the same day.…

When you purchase through links in our articles, [we may earn a small commission](https://runtimewire.com/affiliate-monetization-standards). This doesn’t affect our editorial independence.
