Grok Build shared links expose thousands of company apps

Grok Build, the vibe-coding agent from SpaceXSI (the name given to the merged SpaceX and xAI), is exposing data from thousands of its users, including from the company that sells it. According to Ars Technica, which relays research by the security firm Claroc, the leak comes from the links that let users share the apps they build. Claroc notified SpaceXSI on Sunday, and the article was published on 10 November 2026.

What Claroc found

Claroc says the exposed data includes internal business plans, advertising proposals, medical exam results, crew checklists and lists of employees with their ID numbers. Two dozen apps built by SpaceXSI itself were also open, according to the firm. They included an onboarding plan marked confidential for a new member of the enterprise sales team, a sales territory map covering 594 accounts, internal addresses of sales tools and advertising proposals. "We were shocked," Claroc wrote in its post.

Ars Technica lists several examples attributed to Claroc's findings:

• a Peruvian construction company: an occupational-health dashboard with 3,784 worker medical exams;
• Tesla: a service-center scorecard naming 22 technicians, with productivity and bonus status;
• a contractor working for the US Navy: a roster of 108 people;
• a healthcare company: a hospital staff app listing about 3,565 employees by name and ID;
• a US home construction company: a call sheet with about 583 home-buyer prospects, their budgets and financing notes;
• an auto transport company: a quote desk with about 4,000 transport orders, prices and margins.

Claroc says it is notifying the companies concerned. After the findings were shared with the CISO of a luxury cruise company, that company brought in its whole security team and, according to Claroc, is working to contain the exposure.

Why the links can be listed

Each Grok Build link starts with two or more randomly generated words, followed by the grok.me domain. The idea, known as capability-based access control, is that knowing the exact address is enough to authorise access, and that the address is too long to guess. Ars Technica explains that a three-word phrase offers roughly 38 bits of entropy, which means billions of combinations.

The flaw, according to the article, is where the random part sits. In Grok Build it is to the left of the domain, in the host name. That lets passive DNS services, which record in a searchable database every name that servers look up, list the addresses. Google Docs links, by contrast, put the secret in the path, to the right of the domain, so DNS never sees it. Claroc's CTO, Asaf Aprozper, says a passive DNS search returned 43,601 addresses ending in grok.me, of which more than 35,000, nearly 95 percent, opened the app and all its data.

Disputed defaults and other platforms

A representative of Cursor, the coding service SpaceXSI recently acquired, told Ars Technica that Grok Build apps are "private by default" and that nothing goes public unless the creator shares it. Aprozper's tests, run over the past week, contradict this: by default the link is set to "Anyone with the link", and the user must switch to "invited users" or "only you". The representative did not answer follow-up questions, including why the links were removed after Ars Technica's email.

SpaceXSI began removing the 24 internal apps within a few hours of that email, and all returned an "app not found" error when the article was published. Most of the other data was still reachable at that time. Claroc adds that Lovable, Bolt and Replit also give each app its own web address, so the same DNS records expose them too, but it says it found far more sensitive company data on Grok. Ars Technica notes that Claude's published artifacts, ChatGPT's shared conversations and Gemini put the secret in the path. It also recalls that Meta's Muse agent recently suspended a link-sharing feature after a similar leak.

A precedent from July

This is not the first privacy problem for the tool. According to The Next Web, a researcher known as cereblab published an analysis on 12 July showing that version 0.2.93 of the Grok Build command-line tool packaged developers' entire tracked repositories, with their Git history and any committed secrets, and sent them to a cloud storage bucket. The volume was roughly 27,800 times what the task required, the analysis says. Elon Musk confirmed the uploads and said that SpaceXAI would delete all earlier Grok Build user data. The Next Web adds that no independent audit has confirmed the deletion.

What this changes for a business

For a company that lets employees build internal tools with an AI agent, the lesson is practical: an app generated in minutes can be public by default, without anyone noticing. Before adopting such a tool, it is worth checking the default sharing setting, asking whether links can be listed from outside, and keeping confidential data such as employee lists, price grids or customer files out of prototypes. Treat the vendor's statements about privacy as claims to verify, as the two incidents show, and give a named person responsibility for reviewing which apps are shared and with whom. Where employee or health data is involved, the data protection officer should be informed as soon as an exposure is suspected.