Security researchers found Grok, the AI assistant from SpaceXSI, left 35,578 apps built with Grok Build open to anyone online, no sign-in required. The exposed apps included SpaceXSI’s own confidential material: an onboarding plan, a sales territory map covering 594 strategic accounts, and advertising proposals for X, one of them to a U.S. federal agency.
The findings come from Claroc Research, which published its report, titled “GhostShares 2,” on November 10. The firm says it was not a hack, but the product working as designed: every app Grok Build publishes gets its own address under grok.me, the address lands in passive DNS records when anyone opens it, and the publish step preselects “Anyone with the link.”
How a share link became public
On Grok, the link is the hostname. Each published app lives at an address such as four-random-words.grok.me. Opening one asks a DNS resolver where that name lives, and passive DNS services collect those lookups. Anyone with an account at such a service can search by pattern and list every app ever opened.
Claroc found 43,601 names under grok.me, tried 43,551, and found 37,571 still online. Of those, 35,578, or 94.7 percent, opened for anyone without a sign-in; only 1,993, or 5.3 percent, returned an HTTP 401 error, the response for an app set to “Only you” or “Invited users.” Most open apps were harmless, but Claroc estimates about 1 in 10 held sensitive material and roughly 2 percent held material serious enough to rate high or critical.
What was inside, including SpaceXSI’s own data
Claroc then searched more than 30,000 saved first pages for anything built by SpaceXSI and X staff. It found 24 open apps: the confidential onboarding plan, the 594-account territory map and its sales pipeline, eight X advertising proposals, four live advertiser account boards, one tracking progress toward a $1.6 million sales goal, seven campaign reports, and two copies of an X brand safety playbook.
Beyond SpaceXSI and X, Claroc identified internal data from 30 organizations, 26 with more than 1,000 employees and six of them in the Fortune 500. Confirmed examples include a hospital group’s staff event app with a searchable roster of more than 3,500 employees and a contractor’s staff timesheet whose code held every employee’s password in plain text. Ars Technica named further cases: a Tesla service center scorecard naming 22 technicians and a Peruvian construction firm’s dashboard with 3,784 workers’ medical exam results.
The default did the damage
Claroc built two apps of its own, with made-up data, to test Grok’s defaults. In the paid account used, the publish panel offered “Anyone with the link,” “Invited users” and “Only you,” with “Anyone with the link” already selected. Nothing goes public until the builder clicks Publish, but the access choice is preselected to everyone.
One test app, a contact list Grok was asked to save “so every visitor sees them,” got a database and no sign-in, and a stranger could add a row any visitor would see. The second, a customer list “for my company’s sales team of 4 people,” got sign-in through Google and X, but the code Grok wrote adds whoever signs in to the team before checking membership, so any Google account could read, change and delete customer records.
“AI app builders turned publishing into a few clicks, and the default answer to who can see it is everyone,” Asaf Aprozper, Claroc’s co-founder and chief technology officer, said in the report.
What SpaceXSI said, and what happened next
Claroc reported the issue to SpaceXSI on November 8, through the address in its security.txt file, with the counts, two test apps and four proposed fixes. It flagged two of SpaceXSI’s own open apps that day and the other 22 on November 9. On November 10, SpaceXSI answered a reporter’s questions but had not replied directly to Claroc. The company said Grok apps are private until their creator chooses to share one and that employee accounts default to “Only you.” Claroc’s answer is that extra clicks on a path ending with access set to everyone do not protect the data: the people who published the 35,578 open apps went through every one of those steps.
SpaceXSI began removing the links within hours of Ars Technica sending its questions, and by publication all 24 staff apps returned an “app not found” error. Other users’ apps were left up. A Cursor representative told Ars Technica that “apps are private by default and nothing goes public unless the creator chooses to share it.” Claroc began notifying the affected organizations itself, because SpaceXSI did not say it would reach the app owners.
Why it matters
The pattern has a name because it has happened before. Claroc calls such pages GhostShares, and last month the same trick exposed Meta’s Muse chats. GPTOnline reported on October 21 that Meta paused Muse chat sharing after 6,800 private chats were exposed. The difference is scale: tens of thousands of working apps holding sales pipelines, staff rosters and plain-text passwords.
Claroc found that when it clicked Share on an app ChatGPT built, access was set to “Only me” until changed. Claude, ChatGPT and Gemini put the secret part of the link in the path, so DNS never sees it. Grok’s combination of a preselected public default and a hostname that lands in passive DNS is what turned a share link into a public index. It is also the second Grok Build privacy incident in four months: in July, researcher cereblab showed version 0.2.93 was uploading users’ entire Git repositories to SpaceXSI cloud storage.
