Grok Build Exposes 35,000 Apps and SpaceXSI's Own Confidential Data
Security by design failed at scale. The AI coding agent from SpaceXSI, Grok Build, had more than 35,000 of its applications exposed publicly on the internet — and among them, 24 internal apps built by the company itself. The discovery, made by cybersecurity firm Claroc, reveals not just a configuration error, but a systemic failure in how vibe coding tools are packaged for production use.
What was found
On November 8, 2026, researchers at Claroc were working through a long list of web addresses under the `grok.me` domain — the subdomain where Grok Build publishes the applications users create. No links had been provided by the researchers; they simply found the addresses through passive DNS queries, a method that records subdomain resolutions and makes them searchable.
The first address they opened contained something unexpected: an onboarding plan for a new member of the SpaceXSI enterprise sales team, marked confidential. The document listed first-week system access, internal addresses, sales team tools, 19 internal Slack channels, colleagues to meet, and a 30-day plan. No authentication was required. Anyone with the link could see it.
By scanning the complete list of more than 30,000 saved pages, the researchers identified 24 apps built by SpaceXSI and X staff, including:
- An onboarding plan with internal channels, system passwords, and tools; - A sales territory map covering 594 strategic accounts and their pipeline; - An X advertising proposal for a U.S. federal government agency, also marked confidential; - An internal contest page listing employees by name.
Beyond SpaceXSI itself, the exposed apps contained internal data from 30 identifiable organizations, spanning construction, energy, healthcare, and defense. Of these, 26 have more than 1,000 employees and 6 are Fortune 500 companies.
The types of exposed data were varied: a searchable list of more than 3,500 employees from a hospital group, an intensive care briefing on a single patient, a fire department's live shift board, and a contractor's timesheet whose code held every employee's password in plain text.
How the leak happened
The mechanism is straightforward and devastating. When a user publishes an app built by Grok Build, it receives its own subdomain in the format `word-word-word-word.grok.me`. The creator chooses who can access it: anyone with the link, invited users, or only you.
In Claroc's paid account, the default setting was anyone with the link. This alone would not be catastrophic — the secret would be in the randomness of the identifiers. But researchers discovered that almost all apps published with this setting were accessible: of 43,551 addresses tested, 37,571 were still online, and 35,578 of them (94.7%) opened for anyone without requiring authentication.
The enumerability problem arises from passive DNS. When a browser resolves the subdomain `word-word-word-word.grok.me`, that record is captured by passive DNS services, which index and make it searchable by pattern. Since roughly half of the apps used Grok's own 4-word suggestion, the identifiers followed a predictable pattern — facilitating the sweep.
A Claroc test was even more revealing. The researchers created a customer list app for 4 people with Google and X authentication buttons that Grok itself inserted into the code. The logic, however, was inverted: the app added each person entering the team before verifying they belonged to it. The result: any Google account, even from a stranger, could view, edit, and delete all records.
SpaceXSI's response and what is missing
SpaceXSI took down the 24 internal apps a few hours after Claroc's report was sent — but took no similar action for apps from other users and organizations. The company stated, through a representative, that apps are private by default and that nothing goes public unless the creator clicks publish. Claroc's tests showed the opposite: in the paid plan, the default setting was public.
This is not the first privacy issue with Grok Build. In July 2026, researcher Cereblab discovered that Grok Build's CLI was sending entire source code repositories — including API keys, database passwords, and full commit history — to a Google Cloud Storage bucket, even when the user had disabled the option to use data for model improvement. The volume of data transmitted was approximately 27,800 times greater than necessary for the coding task.
What this means for the future of vibe coding
Grok Build is not unique in its class. Tools like ChatGPT App Builder, Lovable, Bolt, and Replit also generate publishable applications from a single prompt. ChatGPT, however, sets access to only me by default — meaning that even if an address is discovered via passive DNS, the app itself is not accessible to third parties. Grok Build, by contrast, pushes open sharing as the default configuration.
This raises a fundamental question about enterprise adoption of AI coding agents: when the barrier to entry drops to zero, who ensures the security barrier remains?
Apps built by Grok are, essentially, complete web applications with databases and authentication — generated from natural language descriptions by users without formal software engineering training. The convenience is undeniable. But access configuration, permission levels, and security standards are technical decisions that require awareness the average user does not have.
The AI infrastructure sector needs to address this gap. GPU services and AI agent platforms cannot treat sharing as a convenience feature without implementing default-deny policies, automated access configuration audits, and ideally sandboxing that prevents sensitive data from reaching publishable apps in the first place.
The question to watch is whether existing governance models can keep pace as the barrier to entry dissolves — or whether we need a new category of protection designed specifically for an era in which anyone can write software with the same ease as writing an email.
Sources: Ars Technica, The Hacker News, TechRadar
✓ Independent sources cross-checked and verified before publishing
