Security researchers at Claroc have discovered that Grok Build, the AI coding agent from SpaceXSI, left approximately 35,000 applications publicly accessible via shareable links. Ars Technica reports that SpaceXSI is the now-merged entity of Elon Musk's SpaceX and xAI [2], while Claroc describes it as the company formerly called xAI [3]. The exposed apps included confidential internal documents from SpaceXSI itself, as well as sensitive data from Fortune 500 companies, a defense contractor, healthcare providers, and other organizations.
The flaw: links designed to be private, built to be found #
Grok Build lets users create applications by describing them in natural language, then publish them with a shareable link. The links use a "dice word" scheme—random phrases like "failing chassis traders" placed as the subdomain (e.g., https://cinder-crane-sand-frost.grok.me). The intent is capability-based access control: possession of the URL serves as authorization.
But the randomness sits to the left of the domain, not in the path. That means every time someone opens a link, a DNS lookup occurs for a previously unseen hostname. Passive DNS services—which monitor resolver traffic and index hostnames—capture these lookups in publicly searchable databases. Anyone with access to a passive DNS dataset can enumerate the links without ever guessing them [2].
Claroc's CTO Asaf Aprozper said a passive DNS search returned 43,601 hostnames under grok.me. Of the 37,571 apps still online when tested, 35,578 (94.7%) opened without authentication. Only 1,993 returned a 401 error, indicating they were set to "Only you" or "Invited users" [3].
By contrast, platforms including Claude (published artifacts at claude.ai/public/artifacts/), ChatGPT (shared conversations at chatgpt.com/share/), and Gemini ( gemini.google.com/share/) place the secret in the URL path, so DNS never sees it [2].
SpaceXSI's own data was exposed #
Among the open apps, Claroc identified 24 built by SpaceXSI and X staff. These included:
-
A confidential onboarding plan for a new enterprise sales hire, listing internal system addresses, 19 internal chat channels, and a 30-day plan
-
A sales territory map covering 594 strategic accounts
-
Eight X advertising proposals and media plans, including one to a U.S. federal agency marked confidential
-
Four live advertiser account boards tracking campaign spend, one toward a $1.6 million goal
-
Seven campaign reports for advertisers in Brazil, Japan, Korea, and Thailand, several marked confidential or internal
-
Two copies of an X brand safety playbook labeled as an internal sales hub [3] All 24 were accessible on Monday evening. SpaceXSI began removing them within hours of Ars Technica sending questions; by publication the links returned "app not found" errors [2].
Other organizations affected #
Claroc confirmed sensitive data from roughly 30 other identifiable organizations, including:
- Tesla: a service-center scorecard naming 22 technicians with productivity and bonus status
- A U.S. Navy ship engineering contractor: roster of 108 people on a logistics support contract
- A luxury cruise line: galley checklist listing crew by full name and employee ID
- A healthcare company: hospital staff app with ~3,565 employees by name and ID
- A Norwegian-Finnish aerospace and defense group: load board and procedure for an explosives building at a U.S. plant, plus HSE training matrix
- A Peruvian construction company: occupational-health dashboard with 3,784 worker medical exams [2]
Six of the identified organizations are Fortune 500 companies; 26 have more than 1,000 employees [3].
Defaults and disputed claims #
Claroc's testing found that Grok Build's sharing panel defaults to "Anyone with the link" for paid accounts, with "Invited users" and "Only you" as alternatives. The researcher built two test apps; both were published with the default setting pre-selected [3].
A Cursor representative (Cursor was recently acquired by SpaceXSI) told Ars that Grok Build apps are private by default and nothing goes public unless the creator chooses to share it [2]. SpaceXSI said publishing requires several steps including picking an address and accepting a legal disclaimer, and that employee accounts default to "Only you" [3].
Claroc disputes this. In their paid test account, the access step offered three options with "Anyone with the link" already selected. They note that the 24 open SpaceXSI apps were built by staff—meaning either the employee default was not enforced, or staff manually changed it [3].
Broader pattern across AI coding agents #
The hostname-based sharing model is not unique to Grok. Lovable, Bolt, Replit, v0, Base44, Google AI Studio, and Meta's Muse also give each app its own hostname, making them discoverable via passive DNS [3]. Claroc found that Grok simply had "by far the most sensitive company data" among them [2].
Meta's Muse suspended its link-sharing feature last month after a similar exposure [2].
What hardening would change #
Claroc sent SpaceXSI four proposed fixes: serve shared apps on unguessable paths under a single host (so links never become DNS names); add an "everyone in my organization" option limited to the company's email domain; make "Only you" the default and show who can open the app before publish; and warn at publish when an app has a database but no sign-in [3].
They also demonstrated that Grok's generated code for a team app added any Google account to the team before checking membership—effectively bypassing the access control [3].
Response and notification #
Claroc reported the issue to SpaceXSI's security.txt address on November 8, including the full list of app addresses and an offer to share it privately. SpaceXSI had not replied to Claroc as of November 10, though it answered a reporter's questions and took down its own 24 apps. It did not say it would notify other affected app owners [3].
Claroc began notifying organizations directly on November 10. By publication they had emailed three; more notices were going out. They withheld all hostnames, app titles, and identifying details from their public post [3].
What remains unknown #
- How many of the 35,578 open apps contain data that could be modified or deleted by visitors. Claroc proved write access only on their own test apps [3] .
- Whether SpaceXSI will change the default sharing setting or the URL structure for all users.
- Whether other AI coding platforms will move secrets from hostnames to paths.
- The full list of affected organizations beyond the 30 Claroc identified by name.
SpaceXSI's job postings describe Grok Build as part of a "full Super Intelligence stack" alongside Grok models, Grok Bot, Grok Imagine, Grok Voice, and X [1]. The exposure shows that the platform's publishing defaults and link architecture did not match the sensitivity of the data users—including SpaceXSI's own teams—were putting into it.