AppSec · 1 day ago
Claroc found that Grok Build sharing links exposed data from roughly 35,000 apps, including 24 built by SpaceXSI, the platform’s owner. SpaceXSI took its links offline within hours of Ars Technica asking about them, while the investigation found the broader exposure remained.
The URLs were randomized to look private, but a design flaw let people systematically discover live links. Opening one usually revealed the app and its associated data without a company sign-in. Claroc found internal business plans, ad proposals, medical exam results, and employee names and ID numbers among the exposed material.
If staff use Grok Build or similar builders to publish apps through share links, those links can expose sensitive data beyond the company’s sign-in boundary. The reporting does not establish whether anyone accessed or copied the material before the links were removed.
2 sources covering this story
Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords
Researchers found 35,578 Grok-built apps accessible without sign-in, exposing internal data from X, SpaceXSI, and 30 other organizations.
Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Researcher finds 35,000 Grok Build apps wide open to anyone who looked for them.
Part of the PlainSec briefing for 2026-11-12