Grok Build Exposes Data from 35,000 Apps — Including SpaceXSI's Own
A security research team discovered more than 35,000 applications built with Grok Build, the "vibe coding" tool from SpaceXSI (the merged SpaceX and xAI company), configured to be publicly accessible. The problem is not a one-off bug but an architectural decision that contradicts the product's own privacy premises.
What was found
Cybersecurity firm Claroc analyzed addresses under the grok.me domain and discovered that, of 43,551 URLs tested, 37,571 were still online — and 35,578 of them (94.7%) opened for "anyone with the link" without requiring authentication. The exposed data ranged from internal sales plans, territory maps with 594 accounts, advertising proposals for U.S. federal agencies marked as confidential, to medical exam results, employee lists, and cruise line galley checklists.
The most shocking finding: 24 of those applications belonged to SpaceXSI itself. A confidential onboarding plan for a new member of the corporate sales team included access to Okta, Slack, Gmail, HubSpot, Gong, RevSpace, Sales Navigator, and other internal tools. A representative for Cursor, a coding service acquired by SpaceXSI, stated that applications are "private by default," but the reality shown by the research contradicts that claim — Grok Build sets links to "Anyone with the link" by default, and users who do not review this setting publish their projects publicly.
How the leak happens
The technique exploits a passive DNS detail. Instead of placing random tokens to the right of the domain (like `<username>.<app-id>.grok.me`, which would require guessing the username), Grok Build places them to the left (like `four-random-words.grok.me`). This architecture decision means that passive DNS services index the random subdomains, and any researcher can reconstruct a list of active applications without credentials. No authentication needs to be broken — the very routing system makes enumeration viable.
The problem is compounded by the absence of mandatory authentication on shared applications. Grok Build's default flow — clicking "Publish" and receiving "Anyone with the link" as the default selection — means internal applications, even when intended only for testing, end up exposed. When Claroc notified SpaceXSI about the issue, the company was slow to respond; after a researcher's tweet tagging Elon Musk and Grok manager Matt Palmer, the links for SpaceXSI's 24 applications were removed within hours, but most others remained accessible.
The recurring pattern: GhostShares
Claroc named this class of vulnerability "GhostShares" — applications that appear public on the internet to those who were never given the link. The first wave occurred in October, when applications built with Meta Muse were also exposed similarly. Grok Build brought the problem at a larger scale: instead of dozens of applications, there are tens of thousands.
What makes the case especially relevant for the AI agent ecosystem is that Grok Build is not an open-source tool with optional settings. It is a commercial product marketed as a direct replacement for Cursor and Claude Code, with a strong pitch to enterprises. SpaceXSI sold the tool as a secure environment for AI development — but the sharing architecture offers none of the protections that conventional enterprise platforms include: corporate authentication, granular permission lists, audit logs, or any validation mechanism before publishing.
Broader context: Grok Build has been caught in leaks before
This is not Grok Build's first security problem. In July 2026, researchers published a wire-level analysis showing that version 0.2.93 of the Grok Build CLI sent complete Git repositories — with full history, compromised API keys, and committed secrets — to Google Cloud storage buckets, despite SpaceXSI's claims that "nothing from your codebase was transmitted during a session." The upload volume was 27,800 times greater than the data actually needed for the coding task.
What needs to change
SpaceXSI's response to Claroc was defensive: the company claimed that applications are private by default and nothing goes public unless the creator chooses to share. But the data collected by researcher cereblab in July and by Claroc in November show that the product's default is exactly the opposite — "public" is the default setting, and "private" requires deliberate user action.
For enterprises considering Grok Build for internal development, the question is not technical, but governance. AI-generated code platforms that allow publishing via link need, at minimum:
- Mandatory authentication before any application becomes visible; - Email-domain-based permission validation, not just by link; - Audit logs showing who published and when; - Automatic access revocation when a link is reported as insecure.
Does Grok Build have these mechanisms? According to the research itself, not by default. The safest alternative for any organization using tools like this is to regularly review which applications have been published and immediately deactivate those containing sensitive data, even if the platform promises that control is "in your command."
The question is: if the tool SpaceXSI sells to enterprises has already exposed the company's own internal data and data from clients in sectors like healthcare and defense, how many other organizations are operating with a false sense of privacy? The problem is not the AI model — it is the distribution architecture.
Sources: Ars Technica, Claroc, TradersUnion
✓ Independent sources cross-checked and verified before publishing
