35,578 Grok Build apps opened without sign-in, including SpaceXSI's own sales plans

Security firm Claroc found 35,578 apps built with SpaceXSI's Grok Build publicly accessible without sign-in, including 24 apps built by SpaceXSI and X staff that exposed a confidential sales onboarding plan, a territory map covering 594 accounts and advertising proposals, Claroc reported on November 10th, 2026. The exposed apps also included employee rosters, medical data and plain-text passwords, which Claroc attributed to Grok's hostname-based sharing making published tools enumerable through passive DNS. The finding matters because AI app builders let employees publish internal tools outside normal IT review, leaving sensitive data behind a public link pattern.

35,578 Grok Build apps opened without sign-in, including SpaceXSI's own sales plans Claroc opened 35,578 published Grok apps without signing in, including SpaceXSI sales plans, employee rosters, medical data and plain-text passwords. By Ryan Merket https://runtimewire.com/author/ryan-merket · Published Primary source: arstechnica.com https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/ Why it matters AI app builders let employees publish working internal tools in minutes, outside normal IT review, and Grok's hostname-based sharing made those tools enumerable through passive DNS. A sales map, a patient briefing and a staff roster can all end up behind the same public link pattern. Security firm Claroc found 35,578 apps built with SpaceXSI's Grok Build open to anyone on the public internet without a sign-in, including 24 apps built by SpaceXSI and X staff that held a confidential sales onboarding plan, a territory map covering 594 accounts and advertising proposals. Claroc published the research https://blog.claroc.io/ghostshares-grok-build-apps/ on November 10th, 2026, and Ars Technica reported it https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/ the same day.… When you purchase through links in our articles, we may earn a small commission https://runtimewire.com/affiliate-monetization-standards . This doesn’t affect our editorial independence.