Grok Build share links exposed data from 35,000 apps
Claroc found that Grok Build sharing links exposed data from roughly 35,000 apps, including 24 built by SpaceXSI, the platform’s owner. SpaceXSI took its links offline within hours of Ars Technica asking about them, while the investigation found the broader exposure remained.
The URLs were randomized to look private, but a design flaw let people systematically discover live links. Opening one usually revealed the app and its associated data without a company sign-in. Claroc found internal business plans, ad proposals, medical exam results, and employee names and ID numbers among the exposed material.
If staff use Grok Build or similar builders to publish apps through share links, those links can expose sensitive data beyond the company’s sign-in boundary. The reporting does not establish whether anyone accessed or copied the material before the links were removed.