Grok Build apps reportedly exposed sensitive business information that companies may not have intended to share #
Cybersecurity researchers identified more than 35,000 Grok Build applications that could be accessed without signing in, some containing sensitive corporate and employee information. The exposed material reportedly included 3,784 occupational-health examination records and information linked to a US Navy ship engineering contractor.
Researchers also identified 24 publicly accessible applications created by SpaceXSI and X employees, some containing confidential internal information. SpaceXSI subsequently removed the applications, which returned 'App not found' errors.
Thousands of Workers' Records Left Exposed #
Claroc, a cybersecurity firm, identified more than 35,000 Grok Build applications accessible through publicly discoverable links without authentication. Among the findings was an occupational-health dashboard belonging to a Peruvian construction company that contained records of 3,784 worker medical examinations. Researchers also reported finding a roster of 108 personnel associated with a ship engineering contractor supporting a US Navy logistics contract.
Other exposed applications contained a Tesla service-centre scorecard identifying 22 technicians and their bonus status, alongside a healthcare company's roster of approximately 3,565 employees. Claroc co-founder and chief technology officer Asaf Aprozper said affected organisations were being notified. One cruise company's chief information security officer reportedly mobilised its security team after receiving the findings.
Musk's Own Company Had 24 Apps Publicly Accessible #
Confidential company materials were also reportedly found in some of the 24 Grok Build apps linked to SpaceXSI and X personnel. Among the exposed documents were a confidential enterprise sales onboarding plan, a sales territory map covering 594 accounts, internal system addresses, and advertising proposals.
'We were shocked,' Aprozper wrote in a report published by the cybersecurity firm on Tuesday. 'The company that makes Grok had its own internal material open to anyone holding the link, and we had never been given it.'
Claroc said it notified SpaceXSI on Sunday, 8 November, but had received no direct response by the time its report was published. A Claroc official subsequently tagged Musk and Grok manager Matt Palmer on X to raise concerns about the exposure.
The affected applications began becoming inaccessible after it sought comment from SpaceXSI, according to Ars Technica. The outlet reported that all 24 apps had been taken down by the time its article was published, with their links returning an 'App not found' error.
Link-Sharing Features Draw Attention to Data Privacy Risks #
As per Ars Technica, Grok Build lets users create apps through text or voice prompts and share them via URLs containing randomly generated words, such as 'failing chassis traders', before the grok.me domain. Although these words make links harder to guess, placing them in the hostname makes them discoverable through passive DNS databases, which record domain lookups. Google uses a similar sharing method but places random identifiers after its domain in the URL path, where DNS does not capture them.
A Cursor representative said Grok Build apps are private by default and become public only when creators choose to share them. The representative added that ChatGPT, Lovable, and Bolt offer similar shareable links.
However, Aprozper's tests found that 'Anyone with the link' was preselected, requiring users to switch to 'Invited users' or 'Only you' to restrict access. He acknowledged that Lovable, Bolt, and Replit also generate addresses discoverable through DNS records but said, 'Grok is where we found by far the most sensitive company data.'
© Copyright IBTimes 2026. All rights reserved.